Medium WID-SEC-2022-0246 8 CVEs

expat: Mehrere Schwachstellen

Published Jan 17, 2022 · Updated Dec 8, 2025 · Revision 37 · de-DE

Vendor: amazon Vendor: Autodesk Vendor: Avaya Vendor: Broadcom Vendor: Debian Vendor: F5 Vendor: gentoo Vendor: HCL Software Vendor: HPE Vendor: IGEL Vendor: Juniper Networks Vendor: NETAPP Vendor: Oracle Vendor: Red Hat Vendor: SUSE Vendor: Tenable Security Vendor: Ubuntu Product: Aura Application Enablement Services Product: Aura Communication Manager Product: Aura Device Services Product: Aura Experience Portal Product: Aura Session Manager Product: Aura System Manager Product: AutoCAD Product: BIG-IP Product: Breeze Platform Product: CMS Product: Commerce Product: Data ONTAP Product: Enterprise Linux +16 more

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in expat ausnutzen, um einen Denial of Service Angriff durchzuführen oder potentiell Code zur Ausführung zu bringen.

Product

Expat ist ein XML Parser, der in der Programmiersprache-C geschrieben ist.

Vulnerabilities 8

Critical 9.8

CVE-2022-22822 Public exploit

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
Critical 9.8

CVE-2022-22823

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
Critical 9.8

CVE-2022-22824

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
High 8.8

CVE-2021-45960 Public exploit

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can l…

firefox insighttoolkit4 expat swish-e Debian Ubuntu Azure Linux Alpine

Jan 1, 2022
High 8.8

CVE-2022-22825

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
High 8.8

CVE-2022-22826

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
High 8.8

CVE-2022-22827

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
High 8.1

CVE-2021-46143 Public exploit

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

firefox insighttoolkit4 qtwebengine-opensource-src expat Debian Ubuntu Azure Linux Alpine

Jan 6, 2022

Revision history

2025-12-08 #37
Neue Updates von Red Hat aufgenommen
2025-12-04 #36
Neue Updates von Red Hat aufgenommen
2025-01-12 #35
Neue Updates von Ubuntu aufgenommen
2024-07-31 #34
Neue Updates von HP aufgenommen
2024-07-30 #33
Neue Updates von BROCADE aufgenommen
2023-08-17 #32
Neue Updates von F5 aufgenommen
2023-05-09 #31
Neue Updates von Tenable aufgenommen
2023-04-12 #30
Neue Updates von Juniper aufgenommen
2022-12-11 #29
Neue Updates von Amazon aufgenommen
2022-11-15 #28
Neue Updates von Oracle Linux aufgenommen
2022-11-08 #27
Neue Updates von Red Hat aufgenommen
2022-10-26 #26
Neue Updates von Red Hat aufgenommen
2022-10-12 #25
Neue Updates aufgenommen
2022-09-29 #24
Neue Updates von Gentoo aufgenommen
2022-08-01 #23
Neue Updates von Autodesk aufgenommen
2022-07-14 #22
Neue Updates von Amazon aufgenommen
2022-07-07 #21
Neue Updates von Amazon aufgenommen
2022-06-09 #20
Neue Updates von Amazon aufgenommen
2022-05-17 #19
Neue Updates von AVAYA aufgenommen
2022-05-10 #18
Neue Updates von IGEL aufgenommen
2022-05-01 #17
Neue Informationen von F5 aufgenommen
2022-04-27 #16
Neue Updates von Amazon und HCL aufgenommen
2022-04-21 #15
Neue Updates von Red Hat aufgenommen
2022-03-28 #14
Neue Updates von Oracle Linux und Red Hat aufgenommen
2022-03-20 #13
Neue Updates von AVAYA aufgenommen

References

Eintrag in der OSS Mailing-list vom 2022-01-17
http://seclists.org/oss-sec/2022/q1/47
Lipexpat Github vom 2022-01-17
https://github.com/libexpat/libexpat/blob/R_2_4_3/expat/Changes
NetApp Security Advisory NTAP-20220121-0006 vom 2022-01-21
https://security.netapp.com/advisory/ntap-20220121-0006/
SUSE Security Update SUSE-SU-2022:0178-1 vom 2022-01-25
https://lists.suse.com/pipermail/sle-security-updates/2022-January/010063.html
SUSE Security Update SUSE-SU-2022:0179-1 vom 2022-01-25
https://lists.suse.com/pipermail/sle-security-updates/2022-January/010069.html
SUSE Security Update SUSE-SU-2022:14878-1 vom 2022-01-25
https://lists.suse.com/pipermail/sle-security-updates/2022-January/010066.html
Debian Security Advisory DLA-2904 vom 2022-01-30
https://lists.debian.org/debian-lts-announce/2022/01/msg00032.html
Amazon Linux Security Advisory ALAS-2022-017 vom 2022-02-03
https://alas.aws.amazon.com/AL2022/ALAS-2022-017.html
Tenable Security Advisory TNS-2022-05 vom 2022-02-09
https://www.tenable.com/plugins/nessus/157425
Debian Security Advisory DSA-5073 vom 2022-02-12
https://lists.debian.org/debian-security-announce/2022/msg00040.html
Ubuntu Security Notice USN-5288-1 vom 2022-02-21
https://ubuntu.com/security/notices/USN-5288-1
NetApp Security Advisory NTAP-20220131-0004 vom 2022-03-08
https://security.netapp.com/advisory/ntap-20220131-0004/
Ubuntu Security Notice USN-5320-1 vom 2022-03-10
https://ubuntu.com/security/notices/USN-5320-1
Red Hat Security Advisory RHSA-2022:0951 vom 2022-03-16
https://access.redhat.com/errata/RHSA-2022:0951
Oracle Linux Security Advisory ELSA-2022-0951 vom 2022-03-17
http://linux.oracle.com/errata/ELSA-2022-0951.html
Oracle Linux Security Advisory ELSA-2022-9227 vom 2022-03-17
http://linux.oracle.com/errata/ELSA-2022-9227.html
AVAYA Security Advisory ASA-2022-031 vom 2022-03-17
https://downloads.avaya.com/css/P8/documents/101080937
Oracle Linux Security Advisory ELSA-2022-1069 vom 2022-03-28
http://linux.oracle.com/errata/ELSA-2022-1069.html
Red Hat Security Advisory RHSA-2022:1069 vom 2022-03-28
https://access.redhat.com/errata/RHSA-2022:1069
Red Hat Security Advisory RHSA-2022:1476 vom 2022-04-21
https://access.redhat.com/errata/RHSA-2022:1476
Amazon Linux Security Advisory ALAS-2022-1788 vom 2022-04-27
https://alas.aws.amazon.com/AL2/ALAS-2022-1788.html
HCL Article KB0097787 vom 2022-04-28
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097787
F5 Security Advisory K23231802 vom 2022-05-01
https://support.f5.com/csp/article/K23231802
F5 Security Advisory K91589041 vom 2022-05-01
https://support.f5.com/csp/article/K91589041
F5 Security Advisory K23421535 vom 2022-05-01
https://support.f5.com/csp/article/K23421535
IGEL Security Notice ISN-2022-12 vom 2022-05-10
https://kb.igel.com/securitysafety/en/isn-2022-12-teradici-pcoip-library-vulnerabilities-57343640.html
AVAYA Security Advisory ASA-2022-067 vom 2022-05-16
https://downloads.avaya.com/css/P8/documents/101081824
Amazon Linux Security Advisory ALAS-2022-1588 vom 2022-06-10
https://alas.aws.amazon.com/ALAS-2022-1588.html
Amazon Linux Security Advisory ALAS-2022-1603 vom 2022-07-07
https://alas.aws.amazon.com/ALAS-2022-1603.html
Amazon Linux Security Advisory ALAS-2022-1809 vom 2022-07-15
https://alas.aws.amazon.com/AL2/ALAS-2022-1809.html
Autodesk Security Advisory ADSK-SA-2022-0017 vom 2022-08-02
https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0017
Gentoo Linux Security Advisory GLSA-202209-24 vom 2022-09-29
https://security.gentoo.org/glsa/202209-24
Juniper Security Bulletin
https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-Space-Multiple-vulnerabilities-resolved-in-22-2R1-release
Red Hat Security Advisory RHSA-2022:7144 vom 2022-10-27
https://access.redhat.com/errata/RHSA-2022:7144
Red Hat Security Advisory RHSA-2022:7143 vom 2022-10-27
https://access.redhat.com/errata/RHSA-2022:7143
Red Hat Security Advisory RHSA-2022:7692 vom 2022-11-08
https://access.redhat.com/errata/RHSA-2022:7692
Oracle Linux Security Advisory ELSA-2022-7692 vom 2022-11-15
https://linux.oracle.com/errata/ELSA-2022-7692.html
Amazon Linux Security Advisory ALAS-2022-232 vom 2022-12-09
https://alas.aws.amazon.com/AL2022/ALAS-2022-232.html
Juniper Security Bulletin vom 2023-04-13
https://supportportal.juniper.net/s/article/2023-04-Security-Bulletin-Junos-OS-Multiple-vulnerabilities-in-expat-resolved?language=en_US
Tenable Security Advisory TNS-2023-19 vom 2023-05-10
https://www.tenable.com/security/tns-2023-19
F5 Security Advisory K23231802 vom 2023-08-17
https://my.f5.com/manage/s/article/K23231802
F5 Security Advisory K91589041 vom 2023-08-17
https://my.f5.com/manage/s/article/K91589041
Brocade Security Advisory BSA-2024-1960 vom 2024-07-30
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24611
HPE Security Bulletin vom 2024-08-01
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbst04679en_us&docLocale=en_US
Ubuntu Security Notice USN-7199-1 vom 2025-01-13
https://ubuntu.com/security/notices/USN-7199-1
Red Hat Security Advisory RHSA-2025:22785 vom 2025-12-05
https://access.redhat.com/errata/RHSA-2025:22785
Red Hat Security Advisory RHSA-2025:22871 vom 2025-12-09
https://access.redhat.com/errata/RHSA-2025:22871