Lucene search
AmazonALAS-2022-1570HistoryMar 07, 2022 - 11:17 p.m.
Important: expat
2022-03-0723:17:00
alas.aws.amazon.com
46
expat
integer overflow
storerawnames
denial of service
arbitrary code execution
cve-2022-25315
update
red hat
mitre
CVSS2
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.025
Percentile
90.3%
Issue Overview:
An integer overflow was found in expat. The issue occurs in storeRawNames() by abusing the m_buffer expansion logic to allow allocations very close to INT_MAX and out-of-bounds heap writes. This flaw can cause a denial of service or potentially arbitrary code execution. (CVE-2022-25315)
Affected Packages:
expat
Issue Correction:
Run yum update expat to update your system.
New Packages:
i686:
expat-debuginfo-2.1.0-12.26.amzn1.i686
expat-devel-2.1.0-12.26.amzn1.i686
expat-2.1.0-12.26.amzn1.i686
src:
expat-2.1.0-12.26.amzn1.src
x86_64:
expat-debuginfo-2.1.0-12.26.amzn1.x86_64
expat-devel-2.1.0-12.26.amzn1.x86_64
expat-2.1.0-12.26.amzn1.x86_64
Additional References
Red Hat: CVE-2022-25315
Mitre: CVE-2022-25315
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | i686 | expat-debuginfo | < 2.1.0-12.26.amzn1 | expat-debuginfo-2.1.0-12.26.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | expat-devel | < 2.1.0-12.26.amzn1 | expat-devel-2.1.0-12.26.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | expat | < 2.1.0-12.26.amzn1 | expat-2.1.0-12.26.amzn1.i686.rpm |
| Amazon Linux | 1 | x86_64 | expat-debuginfo | < 2.1.0-12.26.amzn1 | expat-debuginfo-2.1.0-12.26.amzn1.x86_64.rpm |
| Amazon Linux | 1 | x86_64 | expat-devel | < 2.1.0-12.26.amzn1 | expat-devel-2.1.0-12.26.amzn1.x86_64.rpm |
| Amazon Linux | 1 | x86_64 | expat | < 2.1.0-12.26.amzn1 | expat-2.1.0-12.26.amzn1.x86_64.rpm |
Related
ubuntucve
ubuntucve
CVE-2022-25315
2022-02-18 00:00:00
redhatcve
redhatcve
CVE-2022-25315
2022-02-21 05:20:45
githubexploit
githubexploit
Exploit for Integer Overflow or Wraparound in Libexpat Project Libexpat
2022-05-11 09:31:06
Exploit for Integer Overflow or Wraparound in Libexpat Project Libexpat
2022-05-12 11:07:10
Exploit for Integer Overflow or Wraparound in Libexpat Project Libexpat
2023-04-06 05:42:39
osv
osv
CVE-2022-25315
2022-02-18 05:15:08
expat vulnerabilities and regression
2022-03-10 13:19:12
expat - security update
2022-03-07 00:00:00
cnvd
cnvd
Expat integer overflow vulnerability (CNVD-2022-18355)
2022-02-22 00:00:00
veracode
veracode
Denial Of Service (DoS)
2022-02-20 22:19:21
cbl_mariner
cbl_mariner
CVE-2022-25315 affecting package expat for versions less than 2.4.8-1
2022-04-26 20:17:03
CVE-2022-25315 affecting package expat 2.4.4-1
2022-03-09 18:31:42
nessus
nessus
Amazon Linux 2 : expat (ALAS-2022-1759)
2022-03-08 00:00:00
Amazon Linux AMI : expat (ALAS-2022-1570)
2022-03-08 00:00:00
Photon OS 4.0: Expat PHSA-2022-4.0-0158
2024-07-23 00:00:00
nvd
nvd
CVE-2022-25315
2022-02-18 05:15:08
debiancve
debiancve
CVE-2022-25315
2022-02-18 05:15:08
alpinelinux
alpinelinux
CVE-2022-25315
2022-02-18 05:15:08
prion
prion
Integer overflow
2022-02-18 05:15:00
cvelist
cvelist
CVE-2022-25315
2022-02-18 04:24:43
cve
cve
CVE-2022-25315
2022-02-18 05:15:08
amazon
amazon
Important: expat, thunderbird
2022-03-07 23:31:00
Important: thunderbird
2022-04-25 22:56:00
photon
photon
Critical Photon OS Security Update - PHSA-2022-0366
2022-02-28 00:00:00
Critical Photon OS Security Update - PHSA-2022-3.0-0366
2022-03-02 00:00:00
Critical Photon OS Security Update - PHSA-2022-0158
2022-02-28 00:00:00
openvas
openvas
Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2023-2143)
2023-06-09 00:00:00
Huawei EulerOS: Security Advisory for expat (EulerOS-SA-2024-2266)
2024-08-22 00:00:00
Fedora: Security Advisory for thunderbird (FEDORA-2022-f202d1a045)
2022-03-23 00:00:00
redhat
redhat
(RHSA-2022:1070) Important: expat security update
2022-03-28 08:46:43
(RHSA-2022:1068) Important: expat security update
2022-03-28 08:40:33
(RHSA-2022:1012) Important: expat security update
2022-03-22 15:14:32
oraclelinux
oraclelinux
expat security update
2022-05-06 00:00:00
firefox security and bug fix update
2022-03-10 00:00:00
firefox security update
2022-03-10 00:00:00
ubuntu
ubuntu
Expat vulnerabilities and regression
2022-03-10 00:00:00
cloudfoundry
cloudfoundry
USN-5320-1: Expat vulnerabilities and regression | Cloud Foundry
2022-04-21 00:00:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities in IBM HTTP Server shipped in IBM WebSphere Application Server Patterns due to Expat vulnerabilities
2022-04-29 19:27:25
f5
f5
fedora
fedora
[SECURITY] Fedora 35 Update: mingw-expat-2.4.6-1.fc35
2022-03-01 18:20:49
[SECURITY] Fedora 34 Update: mingw-expat-2.4.6-1.fc34
2022-03-01 18:37:17
suse
suse
Security update for expat (important)
2022-03-04 00:00:00
Security update for expat (important)
2022-07-06 00:00:00
redos
redos
ROS-20220225-01
2022-02-25 00:00:00
debian
debian
[SECURITY] [DSA 5085-1] expat security update
2022-02-22 20:17:14
[SECURITY] [DLA 2935-1] expat security update
2022-03-07 13:35:55
slackware
slackware
[slackware-security] expat
2022-02-20 05:16:42
mageia
mageia
Updated expat packages fix security vulnerability
2022-02-22 23:15:16
Updated firefox/nss/rootcerts packages fix security vulnerability
2022-04-29 01:46:19
Updated thunderbird packages fix security vulnerabilities
2022-04-29 01:46:19
almalinux
almalinux
Important: mingw-expat security update
2022-11-08 00:00:00
Critical: firefox security update
2022-03-10 14:36:51
Important: thunderbird security update
2022-03-14 09:49:10
centos
centos
firefox security update
2022-03-29 13:53:09
thunderbird security update
2022-03-29 13:54:14
expat security update
2022-03-29 22:31:03
rocky
rocky
firefox security update
2022-03-10 14:36:51
thunderbird security update
2022-03-14 09:49:10
expat security update
2022-03-16 15:13:06
CVSS2
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.025
Percentile
90.3%
Related for ALAS-2022-1570