CVE-2022-25236

 

Published at: - 16-02-2022 02:15

Last modified: - 25-01-2023 07:37

Total changes: - 17

Description

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://github.com/libexpat/libexpat/pull/561
• [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes-Mailing List, Third Party Advisory
• DSA-5085-Third Party Advisory
• FEDORA-2022-04f206996b-Third Party Advisory
• FEDORA-2022-3d9d67f558-Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220303-0008/
• [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update-Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.html
• http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• GLSA-202209-24-Third Party Advisory

 

Keywords

NVD

 

CVE-2022-25236

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures