CVE-2022-40674
CVE-2022-40674
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
CVSS 8.1 · High · EPSS 2.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
expat Debian:12
- Affected ranges
- ECOSYSTEM: < 2.4.8-2
Update to 2.4.8-2
expat Debian:13
- Affected ranges
- ECOSYSTEM: < 2.4.8-2
Update to 2.4.8-2
expat Debian:14
- Affected ranges
- ECOSYSTEM: < 2.4.8-2
Update to 2.4.8-2
libxmltok Debian:12
- Versions
- 1.2-4
- 1.2-4.1
- 1.2-4.1~exp1
- 1.2-4.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
expat Ubuntu:Pro:14.04:LTS
- Versions
- 2.1.0-4
- 2.1.0-4ubuntu1
- 2.1.0-4ubuntu1.1
- 2.1.0-4ubuntu1.2
- 2.1.0-4ubuntu1.3
- 2.1.0-4ubuntu1.4
- 2.1.0-4ubuntu1.4+esm1
- 2.1.0-4ubuntu1.4+esm2
- 2.1.0-4ubuntu1.4+esm4
- 2.1.0-4ubuntu1.4+esm6
- Affected ranges
- ECOSYSTEM: < 2.1.0-4ubuntu1.4+esm7
Update to 2.1.0-4ubuntu1.4+esm7
coin3 Ubuntu:Pro:14.04:LTS
- Versions
- 3.1.4~abc9f50-3
- 3.1.4~abc9f50-4
- 3.1.4~abc9f50-4ubuntu2
- 3.1.4~abc9f50-4ubuntu2+esm1
- 3.1.4~abc9f50-4ubuntu2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vnc4 Ubuntu:Pro:14.04:LTS
- Versions
- 4.1.1+xorg4.3.0-37ubuntu5
- 4.1.1+xorg4.3.0-37ubuntu5.0.1
- 4.1.1+xorg4.3.0-37ubuntu5.0.2
- 4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vtk Ubuntu:Pro:14.04:LTS
- Versions
- 5.8.0-14ubuntu1
- 5.8.0-14ubuntu3
- 5.8.0-14.1ubuntu2
- 5.8.0-14.1ubuntu3
- 5.8.0-14.1ubuntu3+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xmlrpc-c Ubuntu:Pro:14.04:LTS
- Versions
- 1.16.33-3.2ubuntu3
- 1.33.06-0ubuntu1
- 1.33.06-0ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
expat Ubuntu:Pro:16.04:LTS
- Versions
- 2.1.0-7
- 2.1.0-7ubuntu0.16.04.1
- 2.1.0-7ubuntu0.16.04.2
- 2.1.0-7ubuntu0.16.04.3
- 2.1.0-7ubuntu0.16.04.4
- 2.1.0-7ubuntu0.16.04.5
- 2.1.0-7ubuntu0.16.04.5+esm2
- 2.1.0-7ubuntu0.16.04.5+esm5
- Affected ranges
- ECOSYSTEM: < 2.1.0-7ubuntu0.16.04.5+esm6
Update to 2.1.0-7ubuntu0.16.04.5+esm6
ayttm Ubuntu:Pro:16.04:LTS
- Versions
- 0.6.3-3build1
- 0.6.3-3ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cableswig Ubuntu:Pro:16.04:LTS
- Versions
- 0.1.0+git20150808-1
- 0.1.0+git20150808-2
- 0.1.0+git20150808-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cadaver Ubuntu:16.04:LTS
- Versions
- 0.23.3-2ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
coin3 Ubuntu:Pro:16.04:LTS
- Versions
- 3.1.4~abc9f50+dfsg1-1
- 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1
- 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
insighttoolkit Ubuntu:Pro:16.04:LTS
- Versions
- 3.20.1+git20120521-6
- 3.20.1+git20120521-6build1
- 3.20.1+git20120521-6ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
insighttoolkit4 Ubuntu:16.04:LTS
- Versions
- 4.8.1-1ubuntu3
- 4.8.1-1ubuntu4
- 4.8.2-3.1ubuntu1
- 4.9.0-3ubuntu2
- 4.9.0-4ubuntu1
- 4.9.0-4ubuntu1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
matanza Ubuntu:16.04:LTS
- Versions
- 0.13+ds1-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
smart Ubuntu:16.04:LTS
- Versions
- 1.4-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
swish-e Ubuntu:Pro:16.04:LTS
- Versions
- 2.4.7-4
- 2.4.7-4build1
- 2.4.7-4ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tdom Ubuntu:16.04:LTS
- Versions
- 0.8.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vnc4 Ubuntu:Pro:16.04:LTS
- Versions
- 4.1.1+xorg4.3.0-37.3ubuntu2
- 4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vtk Ubuntu:Pro:16.04:LTS
- Versions
- 5.10.1+dfsg-2
- 5.10.1+dfsg-2build3
- 5.10.1+dfsg-2.1build1
- 5.10.1+dfsg-2.1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
wbxml2 Ubuntu:16.04:LTS
- Versions
- 0.10.7-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/libexpat/libexpat/pull/629
- https://github.com/libexpat/libexpat/pull/640
- https://www.debian.org/security/2022/dsa-5236
- https://lists.debian.org/debian-lts-announce/2022/09/msg00029.html
- https://security.gentoo.org/glsa/202209-24
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2ZKEPGFCZ7R6DRVH3K6RBJPT42ZBEG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J2IGJNHFV53PYST7VQV3T4NHVYAMXA36/
- https://security.netapp.com/advisory/ntap-20221028-0008/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSVZN3IJ6OCPSJL7AEX3ZHSHAHFOGESK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQB6FJAM5YQ35SF5B2MN25Y2FX56EOEZ/
- https://security.gentoo.org/glsa/202211-06
- https://cert-portal.siemens.com/productcert/html/ssa-558014.html
- https://cert-portal.siemens.com/productcert/html/ssa-892048.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-40674