CVE-2022-23852: Integer Overflow
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XMLGetBuffer, for configurations with a nonzero XMLCONTEXTBYTES.
Other sources
Expat (aka libexpat) could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the XMLGetBuffer function. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
expat (libexpat) is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to integer overflow. The highest threat from this vulnerability is to availability, confidentiality and integrity.
In XMLGetBuffer of xmlparse.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/expatto a version that resolves this vulnerability.Fixed in 0:2.1.0-14.el7_9 - Upgrade
Upgrade
redhat/expatto a version that resolves this vulnerability.Fixed in 0:2.2.5-4.el8_5.3 - Upgrade
Upgrade
redhat/expatto a version that resolves this vulnerability.Fixed in 0:2.2.5-4.el8_4.3 - Upgrade
Upgrade
redhat/expatto a version that resolves this vulnerability.Fixed in 2.4.4 - Upgrade
Upgrade
debian/expatto a version that resolves this vulnerability.Fixed in 2.5.0-1+deb12u2Fixed in 2.5.0-1+deb12u5Fixed in 2.8.3-1~deb13u1Fixed in 2.9.0-1~deb13u1Fixed in 2.9.0-1Fixed in 2.10.0-1 - Upgrade
Upgrade
alpine/expatto a version that resolves this vulnerability.Fixed in 2.2.10-r1 - Upgrade
Upgrade
alpine/expatto a version that resolves this vulnerability.Fixed in 2.2.10-r3 - Upgrade
Upgrade
alpine/expatto a version that resolves this vulnerability.Fixed in 2.4.4-r0 - Upgrade
Upgrade
alpine/qt5-qtwebengineto a version that resolves this vulnerability.Fixed in 5.15.3_git20211127-r4 - Upgrade
Upgrade
alpine/qt5-qtwebengineto a version that resolves this vulnerability.Fixed in 5.15.3_git20220121-r4 - Upgrade
Upgrade
android/platform/external/expatto a version that resolves this vulnerability.Fixed in 10:2022-09-01 - Upgrade
Upgrade
android/platform/external/expatto a version that resolves this vulnerability.Fixed in 11:2022-09-01 - Upgrade
Upgrade
android/platform/external/expatto a version that resolves this vulnerability.Fixed in 12:2022-09-01 - Upgrade
Upgrade
android/platform/external/expatto a version that resolves this vulnerability.Fixed in 12L:2022-09-01 - Upgrade
Upgrade
debian/expatto a version that resolves this vulnerability.Fixed in 2.4.3-2 - Upgrade
Upgrade
Expat (libexpat)to a version that resolves this vulnerability.Fixed in 2.4.4
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-23852?
CVE-2022-23852 is a vulnerability in expat (libexpat) that can cause process interruption due to an integer overflow when processing a large number of prefixed XML attributes on a single tag.
What is the severity of CVE-2022-23852?
The severity of CVE-2022-23852 is critical with a CVSS score of 9.8.
What is affected by CVE-2022-23852?
Expat (libexpat) versions before 2.4.4 are affected by CVE-2022-23852.
How can I fix CVE-2022-23852?
To fix CVE-2022-23852, update expat to version 2.4.4.
Where can I find more information about CVE-2022-23852?
You can find more information about CVE-2022-23852 at the following references: [link1](https://github.com/libexpat/libexpat/pull/550), [link2](https://bugzilla.suse.com/1195054), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2052320).