Debian Libxmltok vulnerabilities

CVE-2022-25314 [HIGH] CVE-2022-25314: expat - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString... In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. Scope: local bookworm: resolved (fixed in 2.4.5-1) bullseye: resolved (fixed in 2.2.10-2+deb11u2) forky: resolved (fixed in 2.4.5-1) sid: resolved (fixed in 2.4.5-1) trixie: resolved (fixed in 2.4.5-1)

CVE-2024-8176 [HIGH] CVE-2024-8176: expat - A stack overflow vulnerability exists in the libexpat library due to the way it ... A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploita

CVE-2022-40674 [HIGH] CVE-2022-40674: expat - libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse... libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. Scope: local bookworm: resolved (fixed in 2.4.8-2) bullseye: resolved (fixed in 2.2.10-2+deb11u4) forky: resolved (fixed in 2.4.8-2) sid: resolved (fixed in 2.4.8-2) trixie: resolved (fixed in 2.4.8-2)

CVE-2021-46143 [HIGH] CVE-2021-46143: expat - In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overf... In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. Scope: local bookworm: resolved (fixed in 2.4.3-1) bullseye: resolved (fixed in 2.2.10-2+deb11u1) forky: resolved (fixed in 2.4.3-1) sid: resolved (fixed in 2.4.3-1) trixie: resolved (fixed in 2.4.3-1)

CVE-2024-45490 [HIGH] CVE-2024-45490: expat - An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a n... An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. Scope: local bookworm: resolved (fixed in 2.5.0-1+deb12u1) bullseye: resolved (fixed in 2.2.10-2+deb11u6) forky: resolved (fixed in 2.6.2-2) sid: resolved (fixed in 2.6.2-2) trixie: resolved (fixed in 2.6.2-2)

CVE-2022-23990 [HIGH] CVE-2022-23990: expat - Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog functi... Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. Scope: local bookworm: resolved (fixed in 2.4.3-3) bullseye: resolved (fixed in 2.2.10-2+deb11u1) forky: resolved (fixed in 2.4.3-3) sid: resolved (fixed in 2.4.3-3) trixie: resolved (fixed in 2.4.3-3)

CVE-2024-28757 [HIGH] CVE-2024-28757: expat - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isola... libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.6.1-2) sid: resolved (fixed in 2.6.1-2) trixie: resolved (fixed in 2.6.1-2)

CVE-2023-52425 [HIGH] CVE-2023-52425: expat - libexpat through 2.5.0 allows a denial of service (resource consumption) because... libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. Scope: local bookworm: resolved (fixed in 2.5.0-1+deb12u2) bullseye: resolved (fixed in 2.2.10-2+deb11u6) forky: resolved (fixed in 2.6.0-1) sid: resolved (fixed in 2.6.0-1) trixie:

CVE-2022-43680 [HIGH] CVE-2022-43680: expat - In libexpat through 2.4.9, there is a use-after free caused by overeager destruc... In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. Scope: local bookworm: resolved (fixed in 2.5.0-1) bullseye: resolved (fixed in 2.2.10-2+deb11u5) forky: resolved (fixed in 2.5.0-1) sid: resolved (fixed in 2.5.0-1) trixie: resolved (fixed in 2.5.0-1)

CVE-2016-5300 [MEDIUM] CVE-2016-5300: expat - The XML parser in Expat does not use sufficient entropy for hash initialization,... The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876. Scope: local bookworm: resolved (fixed in 2.1.1-3) bullseye: resolved (fixed

CVE-2015-1283 [MEDIUM] CVE-2015-1283: expat - Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0,... Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716. Scope: local bookworm: resolved (fixed in 2.1

CVE-2009-3560 [MEDIUM] CVE-2009-3560: audacity - The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in ... The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-20

CVE-2009-3720 [MEDIUM] CVE-2009-3720: audacity - The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as ... The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625. Scope: local bookwor

CVE-2022-25313 [MEDIUM] CVE-2022-25313: expat - In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion i... In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. Scope: local bookworm: resolved (fixed in 2.4.5-1) bullseye: resolved (fixed in 2.2.10-2+deb11u2) forky: resolved (fixed in 2.4.5-1) sid: resolved (fixed in 2.4.5-1) trixie: resolved (fixed in 2.4.5-1)

CVE-2012-6702 [MEDIUM] CVE-2012-6702: expat - Expat, when used in a parser that has not called XML_SetHashSalt or passed it a ... Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function. Scope: local bookworm: resolved (fixed in 2.1.1-3) bullseye: resolved (fixed in 2.1.1-3) forky: resolved (fixed in 2.1.1-3) sid: resolve

CVE-2024-50602 [MEDIUM] CVE-2024-50602: expat - An issue was discovered in libexpat before 2.6.4. There is a crash within the XM... An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. Scope: local bookworm: resolved (fixed in 2.5.0-1+deb12u2) bullseye: resolved (fixed in 2.2.10-2+deb11u7) forky: resolved (fixed in 2.6.3-2) sid: resolved (fixed in 2.6.3-2) trixie: resolved (fixed in 2.

CVE-2023-52426 [MEDIUM] CVE-2023-52426: expat - libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undef... libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.6.0-1) sid: resolved (fixed in 2.6.0-1) trixie: resolved (fixed in 2.6.0-1)

CVE-2012-0876 [MEDIUM] CVE-2012-0876: expat - The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without r... The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value. Scope: local bookworm: resolved (fixed in 2.1.0~beta3-1) bullseye: resolved (fix

CVE-2012-1148 [MEDIUM] CVE-2012-1148: expat - Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1... Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities. Scope: local bookworm: resolved (fixed in 2.1.0~beta3-1) bullseye: resolved (fixed in