High WID-SEC-2023-2639 14 CVEs

Hitachi Energy AFS: Mehrere Schwachstellen

Published Oct 12, 2023 · Updated Oct 12, 2023 · de-DE

Vendor: Hitachi Energy Product: AFS

Summary

Ein Angreifer kann mehrere Schwachstellen in Hitachi Energy AFS ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen.

Product

ABB FOX Switch (AFS) ist eine Produktfamilie von industriellen Ethernet-Switches für Anwendungen in Versorgungsunternehmen.

Vulnerabilities 14

Critical 9.8

CVE-2022-22822 Public exploit

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
Critical 9.8

CVE-2022-22823

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
Critical 9.8

CVE-2022-22824

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
Critical 9.8

CVE-2022-23852 Public exploit

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML…

thunderbird firefox qt5-qtwebengine insighttoolkit4 Debian Ubuntu Azure Linux Alpine

Jan 24, 2022
Critical 9.8

CVE-2022-25235 Public exploit

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 16, 2022
Critical 9.8

CVE-2022-25236 Public exploit EPSS 35%

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 16, 2022
Critical 9.8

CVE-2022-25315 Public exploit

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 18, 2022
High 8.8

CVE-2021-45960 Public exploit

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can l…

firefox insighttoolkit4 expat swish-e Debian Ubuntu Azure Linux Alpine

Jan 1, 2022
High 8.8

CVE-2022-22825

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
High 8.8

CVE-2022-22826

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
High 8.8

CVE-2022-22827

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
High 8.1

CVE-2021-46143 Public exploit

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

firefox insighttoolkit4 qtwebengine-opensource-src expat Debian Ubuntu Azure Linux Alpine

Jan 6, 2022
High 7.5

CVE-2022-23990 Public exploit

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

thunderbird firefox expat swish-e Debian Ubuntu Azure Linux Alpine

Jan 26, 2022
High 7.5

CVE-2022-25314 Public exploit

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 18, 2022

Revision history

2023-10-12 #1
Initiale Fassung

References

Hitachi Energy Security Advisory 8DBD000165 vom 2023-10-12
https://publisher.hitachienergy.com/preview?DocumentId=8DBD000165&DocumentRevisionId=B&languageCode=en&Preview=true