CVE-2022-25236

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

An XML parser library.

Security Fix(es):

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.(CVE-2022-25235)

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.(CVE-2022-25236)

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.(CVE-2022-25314)

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.(CVE-2022-25313)

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.(CVE-2022-25315)

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo

Security Fix(es):

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.(CVE-2022-25235)

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.(CVE-2022-25236)

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.(CVE-2022-25315)

This package provides with static libraries and header files for developing with expat.

Security Fix(es):

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.(CVE-2022-25235)

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.(CVE-2022-25236)

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.(CVE-2022-25314)

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.(CVE-2022-25313)

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.(CVE-2022-25315)

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo

Security Fix(es):

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.(CVE-2022-25235)

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.(CVE-2022-25236)

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.(CVE-2022-25315)

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 91.7.0 ESR.

Security Fix(es):

• Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

• Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

• expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

• expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)

• expat: Integer overflow in storeRawNames() (CVE-2022-25315)

• Mozilla: Use-after-free in text reflows (CVE-2022-26381)

• Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

• Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

• Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

• Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.7.0.

Security Fix(es):

• Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

• Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

• expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

• expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)

• expat: Integer overflow in storeRawNames() (CVE-2022-25315)

• Mozilla: Use-after-free in text reflows (CVE-2022-26381)

• Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

• Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

• Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

• thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)

• Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat is a C library for parsing XML documents.

Security Fix(es):

• expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

• expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)

• expat: Integer overflow in storeRawNames() (CVE-2022-25315)

• expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)

• expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)

• expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)

• expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)

• expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)

• expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)

• expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)

• expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)

• expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 91.7.0 ESR.

Security Fix(es):

• Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

• Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

• expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

• expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)

• expat: Integer overflow in storeRawNames() (CVE-2022-25315)

• Mozilla: Use-after-free in text reflows (CVE-2022-26381)

• Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

• Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

• Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

• Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 91.7.0.

Security Fix(es):

• Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

• Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

• expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

• expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)

• expat: Integer overflow in storeRawNames() (CVE-2022-25315)

• Mozilla: Use-after-free in text reflows (CVE-2022-26381)

• Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

• Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

• Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

• thunderbird: Crafted email could trigger an out-of-bounds write (CVE-2022-0566)

• Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat is a C library for parsing XML documents. Security Fix(es):

• expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)
• expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)
• expat: Integer overflow in storeRawNames() (CVE-2022-25315)
• expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)
• expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)
• expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)
• expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)
• expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)
• expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)
• expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)
• expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)
• expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat is a C library for parsing XML documents. The mingw-expat packages provide a port of the Expat library for MinGW.

The following packages have been upgraded to a later upstream version: mingw-expat (2.4.8). (BZ#2057023, BZ#2057037, BZ#2057127)

Security Fix(es):

• expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)
• expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)
• expat: Integer overflow in storeRawNames() (CVE-2022-25315)
• expat: Stack exhaustion in doctype parsing (CVE-2022-25313)
• expat: Integer overflow in copyString() (CVE-2022-25314)
• expat: Integer overflow in the doProlog function (CVE-2022-23990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
• CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
• CVE-2022-25315: Fix integer overflow in storeRawNames()
• CVE-2022-22822: Fix integer overflow in addBinding()
• CVE-2022-22823: Fix integer overflow in build_model()
• CVE-2022-22824: Fix integer overflow in defineAttribute()
• CVE-2022-22825: Fix integer overflow in lookup()
• CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
• CVE-2022-22827: Fix integer overflow in storeAtts()
• CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
• CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
• CVE-2021-45960: Fix troublesome left shifts in storeAtts()
• CVE-2022-23990: Fix integer overflow in doProlog()
• CVE-2022-25313: Fix stack exhaustion in build_model()
• CVE-2022-25314: Fix integer overflow in copyString()

• CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
• CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
• CVE-2022-25315: Fix integer overflow in storeRawNames()
• CVE-2022-22822: Fix integer overflow in addBinding()
• CVE-2022-22823: Fix integer overflow in build_model()
• CVE-2022-22824: Fix integer overflow in defineAttribute()
• CVE-2022-22825: Fix integer overflow in lookup()
• CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
• CVE-2022-22827: Fix integer overflow in storeAtts()
• CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
• CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
• CVE-2021-45960: Fix troublesome left shifts in storeAtts()
• CVE-2022-23990: Fix integer overflow in doProlog()
• CVE-2022-25313: Fix stack exhaustion in build_model()
• CVE-2022-25314: Fix integer overflow in copyString()

• CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
• CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
• CVE-2022-25315: Fix integer overflow in storeRawNames()
• CVE-2022-22822: Fix integer overflow in addBinding()
• CVE-2022-22823: Fix integer overflow in build_model()
• CVE-2022-22824: Fix integer overflow in defineAttribute()
• CVE-2022-22825: Fix integer overflow in lookup()
• CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
• CVE-2022-22827: Fix integer overflow in storeAtts()
• CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
• CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
• CVE-2021-45960: Fix troublesome left shifts in storeAtts()
• CVE-2022-23990: Fix integer overflow in doProlog()

• SECURITY UPDATE: Stack exhaustion
  • debian/patches/CVE-2022-25313.patch: prevent stack exhaustion in build_model in expat/lib/xmlparse.c.
  • debian/patches/fix-build_model-regression.patch: fix build_model regression in expat/lib/xmlparse.c.
  • CVE-2022-25313
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2022-25315.patch: prevent integer overflow in storeRawNames in expat/lib/xmlparse.c.
  • CVE-2022-25315
• SECURITY UPDATE: relax fix to CVE-2022-25236 with regard to RFC 3986 URI characters and possibly regressions
  • debian/patches/CVE-2022-25236-3.patch: add a note on namespace URI validation in expat/doc/reference.html, expat/lib/expat.h.
  • debian/patches/CVE-2022-25236-4.patch: document namespace separator effect right in header expat/lib/expat.h.
  • debian/patches/CVE-2022-25236-5.patch: cover relaxed fix in tests.
  • debian/patches/CVE-2022-25236-6.patch: relax fix with regard to RFC 3986 URI characters in expat/lib/xmlparse.c. (LP: #1963903)
• fix tests adding XCS definition
  • debian/patches/fix_test_xcs.patch: in tests/runtests.c.
• SECURITY UPDATE: Realloc misbehavior
  • debian/patches/CVE-2021-45960.patch: detect and prevent troublesome left shifts in function storeAtts in lib/xmlparse.c.
  • CVE-2021-45960
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2021-46143.patch: prevent integer overflow on m_groupSize in function doProlog in lib/xmlparse.c.
  • CVE-2021-46143
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2022-22822-to-CVE-2022-22827.patch: prevent integer overflow in multiple places in lib/xmlparse.c.
  • CVE-2022-22822
  • CVE-2022-22823
  • CVE-2022-22824
  • CVE-2022-22825
  • CVE-2022-22826
  • CVE-2022-22827
• SECURITY UPDATE: Signed integer overflow
  • debian/patches/CVE-2022-23852-*.patch: detect and prevent integer overflow in XML_GetBuffer in expat/lib/xmlparse.c and adds test to cover it in tests/runtests.c.
  • CVE-2022-23852
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2022-23990.patch: prevent integer overflow in doProlog in lib/xmlparse.c.
  • CVE-2022-23990
• SECURITY UPDATE: Incomplete validation encoding
  • debian/patches/CVE-2022-25235-*.patch: adds missing validation and adds tests in expat/lib/xmltok_impl.c, expat/tests/runtests.c.
  • CVE-2022-25235
• SECURITY UPDATE: Namespace-separator insertions
  • debian/patches/CVE-2022-25236-*.patch: Protect against malicious namespace declarations in expat/lib/xmlparse.c, expat/tests/runtests.c.
  • CVE-2022-25236
• debian/patches/fixing_tests.patch: fixing tests in order to it work in xenial and oldest releases.

• CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
• CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
• CVE-2022-25315: Fix integer overflow in storeRawNames()
• CVE-2022-22822: Fix integer overflow in addBinding()
• CVE-2022-22823: Fix integer overflow in build_model()
• CVE-2022-22824: Fix integer overflow in defineAttribute()
• CVE-2022-22825: Fix integer overflow in lookup()
• CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
• CVE-2022-22827: Fix integer overflow in storeAtts()
• CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
• CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
• CVE-2021-45960: Fix troublesome left shifts in storeAtts()
• CVE-2022-23990: Fix integer overflow in doProlog()

Passing malformed 2- and 3-byte UTF-8 sequences (e.g. from start tag names) to the XML processing application on top of Expat can cause arbitrary damage (e.g. code execution) depending on how invalid UTF-8 is handled inside the XML processor; validation was not their job but Expat's. Exploits with code execution are known to exist. (CVE-2022-25235)

Passing (one or more) namespace separator characters in "xmlns[:prefix]" attribute values made Expat send malformed tag names to the XML processor on top of Expat which can cause arbitrary damage (e.g. code execution) depending on such unexpectable cases are handled inside the XML processor; validation was not their job but Expat's. Exploits with code execution are known to exist. (CVE-2022-25236)

Fix stack exhaustion in doctype parsing that could be triggered by e.g. a 2 megabytes file with a large number of opening braces. Expected impact is denial of service or potentially arbitrary code execution. (CVE-2022-25313)

Fix integer overflow in function copyString; only affects the encoding name parameter at parser creation time which is often hardcoded (rather than user input), takes a value in the gigabytes to trigger, and a 64-bit machine. Expected impact is denial of service. (CVE-2022-25314)

Fix integer overflow in function storeRawNames; needs input in the gigabytes and a 64-bit machine. Expected impact is denial of service or potentially arbitrary code execution. (CVE-2022-25315)

NSSToken objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash (CVE-2022-1097).

After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash (CVE-2022-1196).

The rust regex crate did not properly prevent crafted regular expressions from taking an arbitrary amount of time during parsing. If an attacker was able to supply input to this crate, they could have caused a denial of service in the browser (CVE-2022-24713).

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash (CVE-2022-28281).

By using a link with rel="localization" a use-after-free in DocumentL10n::TranslateDocument could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed pointer, leading to a potential exploitable crash (CVE-2022-28282).

When generating the assembly code for MLoadTypedArrayElementHole, an incorrect AliasSet was used in JIT Codegen. In conjunction with another vulnerability this could have been used for an out of bounds memory read (CVE-2022-28285).

Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user confusion or spoofing attacks (CVE-2022-28286).

Mozilla developers and community members Nika Layzell (ni? for response), the Mozilla Fuzzing Team, Andrew McCreight, Gabriele Svelto (pto) reported memory safety bugs present in Firefox ESR 91.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2022-28289).

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. (CVE-2022-25235) xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. (CVE-2022-25236)

An integer overflow was found in expat. The issue occurs in storeRawNames () by abusing the m_buffer expansion logic to allow allocations very close to INT_MAX and out-of-bounds heap writes. (CVE-2022-25315)

The updated thunderbird packages fix security vulnerabilities:

Use-after-free in NSSToken objects (CVE-2022-1097).

Use-after-free after VR Process destruction (CVE-2022-1196).

OpenPGP revocation information was ignored (CVE-2022-1197).

Denial of Service via complex regular expressions (CVE-2022-24713).

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context (CVE-2022-25235).

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs (CVE-2022-25236).

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames (CVE-2022-25315).

Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281).

Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282).

Incorrect AliasSet used in JIT Codegen (CVE-2022-28285).

iframe contents could be rendered outside the border (CVE-2022-28286).

Memory safety bugs fixed in Thunderbird 91.8 (CVE-2022-28289).

This update fixes the vulnerabilities by no longer building with the vulnerable bundled libexpat version.

This update for expat fixes the following issues:

• CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).
• CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).
• CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).
• CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).
• CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).

This update for expat fixes the following issues:

• Fixed a regression caused by the patch for CVE-2022-25236 (bsc#1196784).