UBUNTU-CVE-2022-23990

Details

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Affected Packages(38 packages)

matanza

Ubuntu 16.04 LTS

Affected versions:

0.13+ds1-5

tdom

Ubuntu 16.04 LTS

Affected versions:

0.8.3-1

wbxml2

Ubuntu 16.04 LTS

Affected versions:

0.10.7-1

coin3

Ubuntu 18.04 LTS

Affected versions:

3.1.4~abc9f50+dfsg1-23.1.4~abc9f50+dfsg2-13.1.4~abc9f50+dfsg3-13.1.4~abc9f50+dfsg3-2

expat

Ubuntu 18.04 LTS

Fixed in:

2.2.5-3ubuntu0.4

matanza

Ubuntu 18.04 LTS

Affected versions:

0.13+ds1-5build10.13+ds1-6

tdom

Ubuntu 18.04 LTS

Affected versions:

0.8.3-10.9.0-1

wbxml2

Ubuntu 18.04 LTS

Affected versions:

0.10.7-10.10.7-1build1

expat

Ubuntu 20.04 LTS

Fixed in:

2.2.9-1ubuntu0.2

matanza

Ubuntu 20.04 LTS

Affected versions:

0.13+ds1-60.13+ds2-1

References

REPORT

https://github.com/libexpat/libexpat/pull/551

REPORT

https://ubuntu.com/security/CVE-2022-23990

ADVISORY

https://ubuntu.com/security/notices/USN-5288-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2022-23990