CVE-2022-25235: Input Validation

Published Feb 16, 2022
·
Updated

A flaw was found in expat. Passing malformed 2- and 3-byte UTF-8 sequences (for example, from start tag names) to the XML processing application on top of expat can lead to arbitrary code execution. This issue is dependent on how invalid UTF-8 is handled inside the XML processor.

Other sources

libexpat is vulnerable to a denial of service, caused by improper input validation in xmltokimpl.c. By persuading a victim to open a specially-crafted content with malformed encoding, a remote attacker could exploit this vulnerability to cause a denial of service condition.

— IBM

xmltokimpl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

Affected Software

37 affected componentsFixes available
redhat/expat<0:2.0.1-14.el6_10
0:2.0.1-14.el6_10
redhat/firefox<0:91.7.0-3.el7_9
0:91.7.0-3.el7_9
redhat/thunderbird<0:91.7.0-2.el7_9
0:91.7.0-2.el7_9
redhat/expat<0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
redhat/firefox<0:91.7.0-3.el8_5
0:91.7.0-3.el8_5
redhat/thunderbird<0:91.7.0-2.el8_5
0:91.7.0-2.el8_5
redhat/mingw-expat<0:2.4.8-1.el8
0:2.4.8-1.el8
redhat/expat<0:2.2.5-4.el8_5.3
0:2.2.5-4.el8_5.3
redhat/xmlrpc-c<0:1.51.0-5.el8_5.1
0:1.51.0-5.el8_5.1
redhat/firefox<0:91.7.0-3.el8_1
0:91.7.0-3.el8_1
redhat/thunderbird<0:91.7.0-2.el8_1
0:91.7.0-2.el8_1
redhat/expat<0:2.2.5-3.el8_1.1
0:2.2.5-3.el8_1.1
redhat/xmlrpc-c<0:1.51.0-5.el8_1.1
0:1.51.0-5.el8_1.1
redhat/firefox<0:91.7.0-3.el8_2
0:91.7.0-3.el8_2
redhat/thunderbird<0:91.7.0-2.el8_2
0:91.7.0-2.el8_2
redhat/expat<0:2.2.5-3.el8_2.2
0:2.2.5-3.el8_2.2
redhat/xmlrpc-c<0:1.51.0-5.el8_2.1
0:1.51.0-5.el8_2.1
redhat/firefox<0:91.7.0-3.el8_4
0:91.7.0-3.el8_4
redhat/thunderbird<0:91.7.0-2.el8_4
0:91.7.0-2.el8_4
redhat/expat<0:2.2.5-4.el8_4.2
0:2.2.5-4.el8_4.2
redhat/xmlrpc-c<0:1.51.0-5.el8_4.1
0:1.51.0-5.el8_4.1
redhat/redhat-virtualization-host<0:4.3.22-20220330.1.el7_9
0:4.3.22-20220330.1.el7_9
IBM Engineering Requirements Management DOORS<=9.7.2.8
IBM Engineering Requirements Management DOORS Web Access<=9.7.2.8
IBM IBM® Rational DOORS/DOORS Web Access<=9.6.1.x
Libexpat Project Libexpat<2.4.5
Debian Debian Linux=10.0
Debian Debian Linux=11.0
Fedoraproject Fedora=34
Fedoraproject Fedora=35
Oracle HTTP Server=12.2.1.3.0
Oracle HTTP Server=12.2.1.4.0
Oracle ZFS Storage Appliance Kit=8.8
Siemens SINEMA Remote Connect Server<3.1
redhat/expat<2.4.5
2.4.5
debian/expat
2.2.10-2+deb11u52.2.10-2+deb11u72.5.0-1+deb12u22.5.0-1+deb12u12.7.1-22.8.1-1
debian/libxmltok<=1.2-4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/expat to a version that resolves this vulnerability.

    Fixed in 0:2.0.1-14.el6_10
  2. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el7_9
  3. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el7_9
  4. Upgrade

    Upgrade redhat/expat to a version that resolves this vulnerability.

    Fixed in 0:2.1.0-14.el7_9
  5. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_5
  6. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_5
  7. Upgrade

    Upgrade redhat/mingw-expat to a version that resolves this vulnerability.

    Fixed in 0:2.4.8-1.el8
  8. Upgrade

    Upgrade redhat/expat to a version that resolves this vulnerability.

    Fixed in 0:2.2.5-4.el8_5.3
  9. Upgrade

    Upgrade redhat/xmlrpc-c to a version that resolves this vulnerability.

    Fixed in 0:1.51.0-5.el8_5.1
  10. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_1
  11. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_1
  12. Upgrade

    Upgrade redhat/expat to a version that resolves this vulnerability.

    Fixed in 0:2.2.5-3.el8_1.1
  13. Upgrade

    Upgrade redhat/xmlrpc-c to a version that resolves this vulnerability.

    Fixed in 0:1.51.0-5.el8_1.1
  14. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_2
  15. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_2
  16. Upgrade

    Upgrade redhat/expat to a version that resolves this vulnerability.

    Fixed in 0:2.2.5-3.el8_2.2
  17. Upgrade

    Upgrade redhat/xmlrpc-c to a version that resolves this vulnerability.

    Fixed in 0:1.51.0-5.el8_2.1
  18. Upgrade

    Upgrade redhat/firefox to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-3.el8_4
  19. Upgrade

    Upgrade redhat/thunderbird to a version that resolves this vulnerability.

    Fixed in 0:91.7.0-2.el8_4
  20. Upgrade

    Upgrade redhat/expat to a version that resolves this vulnerability.

    Fixed in 0:2.2.5-4.el8_4.2
  21. Upgrade

    Upgrade redhat/xmlrpc-c to a version that resolves this vulnerability.

    Fixed in 0:1.51.0-5.el8_4.1
  22. Upgrade

    Upgrade redhat/redhat-virtualization-host to a version that resolves this vulnerability.

    Fixed in 0:4.3.22-20220330.1.el7_9
  23. Upgrade

    Upgrade debian/expat to a version that resolves this vulnerability.

    Fixed in 2.2.10-2+deb11u5Fixed in 2.2.10-2+deb11u7Fixed in 2.5.0-1+deb12u2Fixed in 2.5.0-1+deb12u1Fixed in 2.7.1-2Fixed in 2.8.1-1
  24. Upgrade

    Upgrade redhat/expat to a version that resolves this vulnerability.

    Fixed in 2.4.5
  25. Upgrade

    Upgrade expat (libexpat) to a version that resolves this vulnerability.

    Fixed in 2.4.5
  26. Compensating control

    Restrict applications using the expat (libexpat) library from processing untrusted XML content, since there is no known mitigation other than input restriction for this issue.

Event History

Feb 16, 2022
CVE Published
via MITRE·12:40 AM
Data Sourced
via MITRE·12:40 AM
Description
Data Sourced
09:39 PM
SeverityAffected Software
Feb 21, 2022
Data Sourced
via Red Hat·05:24 AM
DescriptionSeverityAffected Software
May 27, 2026
Data Sourced
via Launchpad·11:14 AM
Description
May 28, 2026
Data Sourced
via Ubuntu·11:13 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·11:15 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2022-25235?

The severity of CVE-2022-25235 is classified as critical due to its potential for arbitrary code execution.

2

How do I fix CVE-2022-25235?

To fix CVE-2022-25235, upgrade expat to version 0:2.0.1-14.el6_10 or higher.

3

Which software is affected by CVE-2022-25235?

CVE-2022-25235 affects expat, firefox, and thunderbird across various Red Hat distributions.

4

What impact does CVE-2022-25235 have on my system?

CVE-2022-25235 can lead to arbitrary code execution, potentially compromising system security.

5

Is there a workaround for CVE-2022-25235?

Updating to the recommended versions of the affected software is the suggested approach to mitigate CVE-2022-25235.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203