UBUNTU-CVE-2022-25236

Details

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

Affected Packages(56 packages)

xmlrpc-c

Ubuntu 14.04 LTS

Affected versions:

1.16.33-3.2ubuntu31.33.06-0ubuntu1

ayttm

Ubuntu 16.04 LTS

Affected versions:

0.6.3-3build1

cableswig

Ubuntu 16.04 LTS

Affected versions:

0.1.0+git20150808-10.1.0+git20150808-2

insighttoolkit4

Ubuntu 16.04 LTS

Affected versions:

4.8.1-1ubuntu34.8.1-1ubuntu44.8.2-3.1ubuntu14.9.0-3ubuntu24.9.0-4ubuntu14.9.0-4ubuntu1.1

matanza

Ubuntu 16.04 LTS

Affected versions:

0.13+ds1-5

wbxml2

Ubuntu 16.04 LTS

Affected versions:

0.10.7-1

xmlrpc-c

Ubuntu 16.04 LTS

Affected versions:

1.33.14-0.2ubuntu31.33.14-1ubuntu1

expat

Ubuntu 18.04 LTS

Fixed in:

2.2.5-3ubuntu0.4

matanza

Ubuntu 18.04 LTS

Affected versions:

0.13+ds1-5build10.13+ds1-6

tdom

Ubuntu 18.04 LTS

Affected versions:

0.8.3-10.9.0-1

References

REPORT

https://github.com/libexpat/libexpat/pull/561

REPORT

https://github.com/libexpat/libexpat/pull/561/commits/2de077423fb22750ebea599677d523b53cb93b1d

REPORT

https://github.com/libexpat/libexpat/pull/561/commits/a2fe525e660badd64b6c557c2b1ec26ddc07f6e4

REPORT

https://github.com/libexpat/libexpat/pull/577

REPORT

https://ubuntu.com/security/CVE-2022-25236

ADVISORY

https://ubuntu.com/security/notices/USN-5288-1

ADVISORY

https://ubuntu.com/security/notices/USN-5455-1

ADVISORY

https://ubuntu.com/security/notices/USN-8235-1

ADVISORY

https://ubuntu.com/security/notices/USN-8240-1

ADVISORY

https://ubuntu.com/security/notices/USN-8241-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2022-25236