Moderate: expat security update
Summary
ALSA-2022:5244: Moderate: expat security update. Affects expat versions < 2.2.10-12.el9_0.2. Fixed in 2.2.10-12.el9_0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Expat is a C library for parsing XML documents. It provides a set of functions and APIs for handling XML data. The library is widely used in various applications and frameworks that require XML parsing capabilities. However, the library is vulnerable to two security issues that could potentially be exploited by attackers.
Vulnerability Detail
The first vulnerability (CVE-2022-25313) is a stack exhaustion issue in the doctype parsing functionality of Expat. This vulnerability could lead to a denial of service (DoS) attack by causing the application to consume excessive stack memory. The second vulnerability (CVE-2022-25314) is an integer overflow in the copyString() function of Expat. An attacker could exploit this vulnerability to execute arbitrary code or cause a crash by providing a specially crafted XML document.
Both vulnerabilities have been assigned a moderate severity rating.
Affected Versions:
- Expat 0 and above
Fixed Version:
- Expat 2.2.10-12.el9_0.2
How To Fix
Minimum fixed version
2.2.10-12.el9_0.2
This is the first release that contains the fix.
sudo dnf update expatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Expat, a widely used C library for XML parsing, is vulnerable to two security issues. These vulnerabilities can be fixed by updating the library to version 2.2.10-12.el9_0.2 or later. It is recommended to apply the necessary updates to ensure the security of applications that rely on Expat for XML parsing.
For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for expat →
FAQ
Expat is a C library for parsing XML documents. It provides functions and APIs for handling XML data.
CVE-2022-25313 could lead to a denial of service (DoS) attack by causing excessive stack memory consumption.
CVE-2022-25314 could allow an attacker to execute arbitrary code or cause a crash by providing a specially crafted XML document.
To fix the vulnerabilities, update the Expat library to version 2.2.10-12.el9_0.2 or later.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for expat.
