CVE-2022-25236
CVE-2022-25236
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
CVSS 9.8 · Critical · EPSS 35.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
expat Debian:12
- Affected ranges
- ECOSYSTEM: < 2.4.5-1
Update to 2.4.5-1
expat Debian:13
- Affected ranges
- ECOSYSTEM: < 2.4.5-1
Update to 2.4.5-1
expat Debian:14
- Affected ranges
- ECOSYSTEM: < 2.4.5-1
Update to 2.4.5-1
libxmltok Debian:12
- Versions
- 1.2-4
- 1.2-4.1
- 1.2-4.1~exp1
- 1.2-4.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
expat Ubuntu:Pro:14.04:LTS
- Versions
- 2.1.0-4
- 2.1.0-4ubuntu1
- 2.1.0-4ubuntu1.1
- 2.1.0-4ubuntu1.2
- 2.1.0-4ubuntu1.3
- 2.1.0-4ubuntu1.4
- 2.1.0-4ubuntu1.4+esm1
- 2.1.0-4ubuntu1.4+esm2
- Affected ranges
- ECOSYSTEM: < 2.1.0-4ubuntu1.4+esm4
Update to 2.1.0-4ubuntu1.4+esm4
coin3 Ubuntu:Pro:14.04:LTS
- Versions
- 3.1.4~abc9f50-3
- 3.1.4~abc9f50-4
- 3.1.4~abc9f50-4ubuntu2
- 3.1.4~abc9f50-4ubuntu2+esm1
- Affected ranges
- ECOSYSTEM: < 3.1.4~abc9f50-4ubuntu2+esm2
Update to 3.1.4~abc9f50-4ubuntu2+esm2
xmlrpc-c Ubuntu:Pro:14.04:LTS
- Versions
- 1.16.33-3.2ubuntu3
- 1.33.06-0ubuntu1
- Affected ranges
- ECOSYSTEM: < 1.33.06-0ubuntu1+esm1
Update to 1.33.06-0ubuntu1+esm1
expat Ubuntu:Pro:16.04:LTS
- Versions
- 2.1.0-7
- 2.1.0-7ubuntu0.16.04.1
- 2.1.0-7ubuntu0.16.04.2
- 2.1.0-7ubuntu0.16.04.3
- 2.1.0-7ubuntu0.16.04.4
- 2.1.0-7ubuntu0.16.04.5
- Affected ranges
- ECOSYSTEM: < 2.1.0-7ubuntu0.16.04.5+esm2
Update to 2.1.0-7ubuntu0.16.04.5+esm2
coin3 Ubuntu:Pro:16.04:LTS
- Versions
- 3.1.4~abc9f50+dfsg1-1
- 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: < 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
Update to 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
insighttoolkit Ubuntu:Pro:16.04:LTS
- Versions
- 3.20.1+git20120521-6
- 3.20.1+git20120521-6build1
- Affected ranges
- ECOSYSTEM: < 3.20.1+git20120521-6ubuntu0.1~esm1
Update to 3.20.1+git20120521-6ubuntu0.1~esm1
libxmltok Ubuntu:Pro:16.04:LTS
- Versions
- 1.2-3build3
- 1.2-3ubuntu0.16.04.1~esm1
- Affected ranges
- ECOSYSTEM: < 1.2-3ubuntu0.16.04.1~esm2
Update to 1.2-3ubuntu0.16.04.1~esm2
swish-e Ubuntu:Pro:16.04:LTS
- Versions
- 2.4.7-4
- 2.4.7-4build1
- Affected ranges
- ECOSYSTEM: < 2.4.7-4ubuntu0.1~esm1
Update to 2.4.7-4ubuntu0.1~esm1
ayttm Ubuntu:Pro:16.04:LTS
- Versions
- 0.6.3-3build1
- Affected ranges
- ECOSYSTEM: < 0.6.3-3ubuntu0.1~esm1
Update to 0.6.3-3ubuntu0.1~esm1
cableswig Ubuntu:Pro:16.04:LTS
- Versions
- 0.1.0+git20150808-1
- 0.1.0+git20150808-2
- Affected ranges
- ECOSYSTEM: < 0.1.0+git20150808-2ubuntu0.1~esm1
Update to 0.1.0+git20150808-2ubuntu0.1~esm1
insighttoolkit4 Ubuntu:16.04:LTS
- Versions
- 4.8.1-1ubuntu3
- 4.8.1-1ubuntu4
- 4.8.2-3.1ubuntu1
- 4.9.0-3ubuntu2
- 4.9.0-4ubuntu1
- 4.9.0-4ubuntu1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
matanza Ubuntu:16.04:LTS
- Versions
- 0.13+ds1-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xmlrpc-c Ubuntu:Pro:16.04:LTS
- Versions
- 1.33.14-0.2ubuntu3
- 1.33.14-1ubuntu1
- Affected ranges
- ECOSYSTEM: < 1.33.14-1ubuntu1+esm1
Update to 1.33.14-1ubuntu1+esm1
expat Ubuntu:18.04:LTS
- Versions
- 2.2.3-1
- 2.2.3-2
- 2.2.5-0ubuntu2
- 2.2.5-3
- 2.2.5-3ubuntu0.1
- 2.2.5-3ubuntu0.2
- Affected ranges
- ECOSYSTEM: < 2.2.5-3ubuntu0.4
Update to 2.2.5-3ubuntu0.4
coin3 Ubuntu:Pro:18.04:LTS
- Versions
- 3.1.4~abc9f50+dfsg1-2
- 3.1.4~abc9f50+dfsg2-1
- 3.1.4~abc9f50+dfsg3-1
- 3.1.4~abc9f50+dfsg3-2
- Affected ranges
- ECOSYSTEM: < 3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
Update to 3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
libxmltok Ubuntu:Pro:18.04:LTS
- Versions
- 1.2-4
- Affected ranges
- ECOSYSTEM: < 1.2-4ubuntu0.18.04.1~esm1
Update to 1.2-4ubuntu0.18.04.1~esm1
matanza Ubuntu:18.04:LTS
- Versions
- 0.13+ds1-5build1
- 0.13+ds1-6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
swish-e Ubuntu:Pro:18.04:LTS
- Versions
- 2.4.7-5ubuntu1
- Affected ranges
- ECOSYSTEM: < 2.4.7-5ubuntu1+esm1
Update to 2.4.7-5ubuntu1+esm1
tdom Ubuntu:18.04:LTS
- Versions
- 0.8.3-1
- 0.9.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/libexpat/libexpat/pull/561
- http://www.openwall.com/lists/oss-security/2022/02/19/1
- https://www.debian.org/security/2022/dsa-5085
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/
- https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://security.netapp.com/advisory/ntap-20220303-0008/
- http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://security.gentoo.org/glsa/202209-24
- https://cert-portal.siemens.com/productcert/html/ssa-484086.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-25236