Debian Libxmltok vulnerabilities

CVE-2022-25236 [CRITICAL] CVE-2022-25236: expat - xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert names... xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. Scope: local bookworm: resolved (fixed in 2.4.5-1) bullseye: resolved (fixed in 2.2.10-2+deb11u2) forky: resolved (fixed in 2.4.5-1) sid: resolved (fixed in 2.4.5-1) trixie: resolved (fixed in 2.4.5-1)

CVE-2022-25315 [CRITICAL] CVE-2022-25315: expat - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNa... In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Scope: local bookworm: resolved (fixed in 2.4.5-1) bullseye: resolved (fixed in 2.2.10-2+deb11u2) forky: resolved (fixed in 2.4.5-1) sid: resolved (fixed in 2.4.5-1) trixie: resolved (fixed in 2.4.5-1)

CVE-2022-22822 [CRITICAL] CVE-2022-22822: expat - addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer ove... addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Scope: local bookworm: resolved (fixed in 2.4.3-1) bullseye: resolved (fixed in 2.2.10-2+deb11u1) forky: resolved (fixed in 2.4.3-1) sid: resolved (fixed in 2.4.3-1) trixie: resolved (fixed in 2.4.3-1)

CVE-2022-23852 [CRITICAL] CVE-2022-23852: expat - Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer... Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. Scope: local bookworm: resolved (fixed in 2.4.3-2) bullseye: resolved (fixed in 2.2.10-2+deb11u1) forky: resolved (fixed in 2.4.3-2) sid: resolved (fixed in 2.4.3-2) trixie: resolved (fixed in 2.4.3-2)

CVE-2022-22823 [CRITICAL] CVE-2022-22823: expat - build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer ov... build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Scope: local bookworm: resolved (fixed in 2.4.3-1) bullseye: resolved (fixed in 2.2.10-2+deb11u1) forky: resolved (fixed in 2.4.3-1) sid: resolved (fixed in 2.4.3-1) trixie: resolved (fixed in 2.4.3-1)

CVE-2022-22824 [CRITICAL] CVE-2022-22824: expat - defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an intege... defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Scope: local bookworm: resolved (fixed in 2.4.3-1) bullseye: resolved (fixed in 2.2.10-2+deb11u1) forky: resolved (fixed in 2.4.3-1) sid: resolved (fixed in 2.4.3-1) trixie: resolved (fixed in 2.4.3-1)

CVE-2016-0718 [CRITICAL] CVE-2016-0718: expat - Expat allows context-dependent attackers to cause a denial of service (crash) or... Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. Scope: local bookworm: resolved (fixed in 2.1.1-2) bullseye: resolved (fixed in 2.1.1-2) forky: resolved (fixed in 2.1.1-2) sid: resolved (fixed in 2.1.1-2) trixie: resolved (fixed in 2.1.1

CVE-2022-25235 [CRITICAL] CVE-2022-25235: expat - xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of e... xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. Scope: local bookworm: resolved (fixed in 2.4.5-1) bullseye: resolved (fixed in 2.2.10-2+deb11u2) forky: resolved (fixed in 2.4.5-1) sid: resolved (fixed in 2.4.5-1) trixie: resolved (fixed in 2.4.5-1)

CVE-2016-4472 [MEDIUM] CVE-2016-4472: expat - The overflow protection in Expat is removed by compilers with certain optimizati... The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716. Scope: local bookworm: resolved (fixed in 2.1.1-2) bull

CVE-2021-45960 [HIGH] CVE-2021-45960: expat - In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the... In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). Scope: local bookworm: resolved (fixed in 2.4.3-1) bullseye: resolved (fixed in 2.2.10-2+deb11u1) forky: resolved (fixed in 2.4.3-1) sid: resolved (fixed in 2.4.3-1)

CVE-2024-45492 [CRITICAL] CVE-2024-45492: expat - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c... An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). Scope: local bookworm: resolved (fixed in 2.5.0-1+deb12u1) bullseye: resolved (fixed in 2.2.10-2+deb11u6) forky: resolved (fixed in 2.6.2-2) sid: resolved (fixed in 2.6.2-2) trixie: reso

CVE-2024-45491 [CRITICAL] CVE-2024-45491: expat - An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have... An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). Scope: local bookworm: resolved (fixed in 2.5.0-1+deb12u1) bullseye: resolved (fixed in 2.2.10-2+deb11u6) forky: resolved (fixed in 2.6.2-2) sid: resolved (fixed in 2.6.2-2) trixie: resolved (fi

CVE-2013-0340 [MEDIUM] CVE-2013-0340: expat - expat before version 2.4.0 does not properly handle entities expansion unless an... expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it

CVE-2022-22826 [HIGH] CVE-2022-22826: expat - nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integ... nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Scope: local bookworm: resolved (fixed in 2.4.3-1) bullseye: resolved (fixed in 2.2.10-2+deb11u1) forky: resolved (fixed in 2.4.3-1) sid: resolved (fixed in 2.4.3-1) trixie: resolved (fixed in 2.4.3-1)

CVE-2022-22827 [HIGH] CVE-2022-22827: expat - storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer over... storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Scope: local bookworm: resolved (fixed in 2.4.3-1) bullseye: resolved (fixed in 2.2.10-2+deb11u1) forky: resolved (fixed in 2.4.3-1) sid: resolved (fixed in 2.4.3-1) trixie: resolved (fixed in 2.4.3-1)

CVE-2022-22825 [HIGH] CVE-2022-22825: expat - lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflo... lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Scope: local bookworm: resolved (fixed in 2.4.3-1) bullseye: resolved (fixed in 2.2.10-2+deb11u1) forky: resolved (fixed in 2.4.3-1) sid: resolved (fixed in 2.4.3-1) trixie: resolved (fixed in 2.4.3-1)

CVE-2017-9233 [HIGH] CVE-2017-9233: expat - XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parse... XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD. Scope: local bookworm: resolved (fixed in 2.2.1-1) bullseye: resolved (fixed in 2.2.1-1) forky: resolved (fixed in 2.2.1-1) sid: resolved (fixed in 2.2.1-1) tr

CVE-2016-9063 [CRITICAL] CVE-2016-9063: expat - An integer overflow during the parsing of XML using the Expat library. This vuln... An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. Scope: local bookworm: resolved (fixed in 2.2.0-2) bullseye: resolved (fixed in 2.2.0-2) forky: resolved (fixed in 2.2.0-2) sid: resolved (fixed in 2.2.0-2) trixie: resolved (fixed in 2.2.0-2)

CVE-2018-20843 [HIGH] CVE-2018-20843: expat - In libexpat in Expat before 2.2.7, XML input including XML names that contain a ... In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks). Scope: local bookworm: resolved (fixed in 2.2.6-2) bullseye: resolved (fixed in 2.2.6-2) forky: resolved (fixed in 2.2.6-2)

CVE-2019-15903 [HIGH] CVE-2019-15903: chromium - In libexpat before 2.2.8, crafted XML input could fool the parser into changing ... In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved