CVE-2022-25313

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

An XML parser library.

Security Fix(es):

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.(CVE-2022-25235)

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.(CVE-2022-25236)

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.(CVE-2022-25314)

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.(CVE-2022-25313)

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.(CVE-2022-25315)

This package provides with static libraries and header files for developing with expat.

Security Fix(es):

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.(CVE-2022-25235)

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.(CVE-2022-25236)

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.(CVE-2022-25314)

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.(CVE-2022-25313)

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.(CVE-2022-25315)

Expat is a C library for parsing XML documents.

Security Fix(es):

• expat: stack exhaustion in doctype parsing (CVE-2022-25313)

• expat: integer overflow in copyString() (CVE-2022-25314)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

Expat is a C library for parsing XML documents. Security Fix(es):

• expat: stack exhaustion in doctype parsing (CVE-2022-25313)
• expat: integer overflow in copyString() (CVE-2022-25314) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat is a C library for parsing XML documents. Security Fix(es):

• expat: stack exhaustion in doctype parsing (CVE-2022-25313)
• expat: integer overflow in copyString() (CVE-2022-25314) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat is a C library for parsing XML documents. The mingw-expat packages provide a port of the Expat library for MinGW.

The following packages have been upgraded to a later upstream version: mingw-expat (2.4.8). (BZ#2057023, BZ#2057037, BZ#2057127)

Security Fix(es):

• expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)
• expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)
• expat: Integer overflow in storeRawNames() (CVE-2022-25315)
• expat: Stack exhaustion in doctype parsing (CVE-2022-25313)
• expat: Integer overflow in copyString() (CVE-2022-25314)
• expat: Integer overflow in the doProlog function (CVE-2022-23990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
• CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
• CVE-2022-25315: Fix integer overflow in storeRawNames()
• CVE-2022-22822: Fix integer overflow in addBinding()
• CVE-2022-22823: Fix integer overflow in build_model()
• CVE-2022-22824: Fix integer overflow in defineAttribute()
• CVE-2022-22825: Fix integer overflow in lookup()
• CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
• CVE-2022-22827: Fix integer overflow in storeAtts()
• CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
• CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
• CVE-2021-45960: Fix troublesome left shifts in storeAtts()
• CVE-2022-23990: Fix integer overflow in doProlog()
• CVE-2022-25313: Fix stack exhaustion in build_model()
• CVE-2022-25314: Fix integer overflow in copyString()

• CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
• CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
• CVE-2022-25315: Fix integer overflow in storeRawNames()
• CVE-2022-22822: Fix integer overflow in addBinding()
• CVE-2022-22823: Fix integer overflow in build_model()
• CVE-2022-22824: Fix integer overflow in defineAttribute()
• CVE-2022-22825: Fix integer overflow in lookup()
• CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
• CVE-2022-22827: Fix integer overflow in storeAtts()
• CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
• CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
• CVE-2021-45960: Fix troublesome left shifts in storeAtts()
• CVE-2022-23990: Fix integer overflow in doProlog()
• CVE-2022-25313: Fix stack exhaustion in build_model()
• CVE-2022-25314: Fix integer overflow in copyString()

• SECURITY UPDATE: Stack exhaustion
  • debian/patches/CVE-2022-25313.patch: prevent stack exhaustion in build_model in expat/lib/xmlparse.c.
  • debian/patches/fix-build_model-regression.patch: fix build_model regression in expat/lib/xmlparse.c.
  • CVE-2022-25313
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2022-25315.patch: prevent integer overflow in storeRawNames in expat/lib/xmlparse.c.
  • CVE-2022-25315
• SECURITY UPDATE: relax fix to CVE-2022-25236 with regard to RFC 3986 URI characters and possibly regressions
  • debian/patches/CVE-2022-25236-3.patch: add a note on namespace URI validation in expat/doc/reference.html, expat/lib/expat.h.
  • debian/patches/CVE-2022-25236-4.patch: document namespace separator effect right in header expat/lib/expat.h.
  • debian/patches/CVE-2022-25236-5.patch: cover relaxed fix in tests.
  • debian/patches/CVE-2022-25236-6.patch: relax fix with regard to RFC 3986 URI characters in expat/lib/xmlparse.c. (LP: #1963903)
• fix tests adding XCS definition
  • debian/patches/fix_test_xcs.patch: in tests/runtests.c.
• SECURITY UPDATE: Realloc misbehavior
  • debian/patches/CVE-2021-45960.patch: detect and prevent troublesome left shifts in function storeAtts in lib/xmlparse.c.
  • CVE-2021-45960
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2021-46143.patch: prevent integer overflow on m_groupSize in function doProlog in lib/xmlparse.c.
  • CVE-2021-46143
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2022-22822-to-CVE-2022-22827.patch: prevent integer overflow in multiple places in lib/xmlparse.c.
  • CVE-2022-22822
  • CVE-2022-22823
  • CVE-2022-22824
  • CVE-2022-22825
  • CVE-2022-22826
  • CVE-2022-22827
• SECURITY UPDATE: Signed integer overflow
  • debian/patches/CVE-2022-23852-*.patch: detect and prevent integer overflow in XML_GetBuffer in expat/lib/xmlparse.c and adds test to cover it in tests/runtests.c.
  • CVE-2022-23852
• SECURITY UPDATE: Integer overflow
  • debian/patches/CVE-2022-23990.patch: prevent integer overflow in doProlog in lib/xmlparse.c.
  • CVE-2022-23990
• SECURITY UPDATE: Incomplete validation encoding
  • debian/patches/CVE-2022-25235-*.patch: adds missing validation and adds tests in expat/lib/xmltok_impl.c, expat/tests/runtests.c.
  • CVE-2022-25235
• SECURITY UPDATE: Namespace-separator insertions
  • debian/patches/CVE-2022-25236-*.patch: Protect against malicious namespace declarations in expat/lib/xmlparse.c, expat/tests/runtests.c.
  • CVE-2022-25236
• debian/patches/fixing_tests.patch: fixing tests in order to it work in xenial and oldest releases.

• CVE-2022-25313: prevent stack exhaustion in build_model
• CVE-2024-50602: make XML_StopParser refuse to stop/suspend an unstarted parser

Passing malformed 2- and 3-byte UTF-8 sequences (e.g. from start tag names) to the XML processing application on top of Expat can cause arbitrary damage (e.g. code execution) depending on how invalid UTF-8 is handled inside the XML processor; validation was not their job but Expat's. Exploits with code execution are known to exist. (CVE-2022-25235)

Passing (one or more) namespace separator characters in "xmlns[:prefix]" attribute values made Expat send malformed tag names to the XML processor on top of Expat which can cause arbitrary damage (e.g. code execution) depending on such unexpectable cases are handled inside the XML processor; validation was not their job but Expat's. Exploits with code execution are known to exist. (CVE-2022-25236)

Fix stack exhaustion in doctype parsing that could be triggered by e.g. a 2 megabytes file with a large number of opening braces. Expected impact is denial of service or potentially arbitrary code execution. (CVE-2022-25313)

Fix integer overflow in function copyString; only affects the encoding name parameter at parser creation time which is often hardcoded (rather than user input), takes a value in the gigabytes to trigger, and a 64-bit machine. Expected impact is denial of service. (CVE-2022-25314)

Fix integer overflow in function storeRawNames; needs input in the gigabytes and a 64-bit machine. Expected impact is denial of service or potentially arbitrary code execution. (CVE-2022-25315)

This update fixes the vulnerabilities by no longer building with the vulnerable bundled libexpat version.

This update for expat fixes the following issues:

• CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).
• CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).
• CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).
• CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).
• CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).

These are all security issues fixed in the expat-2.4.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for expat fixes the following issues:

• CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).
• CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).
• CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).
• CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).
• CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).

This update for expat fixes the following issues:

• CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).
• CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).
• CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).
• CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).
• CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).

This update for expat fixes the following issues:

• CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).
• CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).
• CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).
• CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).
• CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).

This update for expat fixes the following issues:

• CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).
• Fixed a regression caused by the patch for CVE-2022-25236 (bsc#1196784).
• CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).
• CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).
• CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).
• CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).

USN-5288-1 fixed several vulnerabilities in Expat. For CVE-2022-25236 it caused a regression and an additional patch was required. This update address this regression and several other vulnerabilities.

It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-25313)

It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-25314)

It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2022-25315)

Original advisory details:

It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2022-25236)