In the Expat 2.4.5 library, used for parsing XML format in many projects, including Apache httpd, OpenOffice, LibreOffice, Firefox, Chromium, Python, and Wayland, five critical vulnerabilities have been fixed, four of which could potentially allow for remote code execution when processing specially crafted XML data in applications using libexpat. There are reports of working exploits for two vulnerabilities. You can track the release of package updates in distributions on these pages: Debian, SUSE, Ubuntu, RHEL, Fedora, Gentoo, Arch Linux.
Identified vulnerabilities:
- CVE-2022-25235 — Buffer overflow due to improper validation of Unicode character encoding, which may lead (an exploit exists) to code execution when processing specially crafted 2 and 3-byte UTF-8 character sequences in XML tag names.
- CVE-2022-25236 — The ability to inject namespace separator characters into the values of the "xmlns[:prefix]" attributes in URIs. This vulnerability allows for code execution when processing attacker-controlled data (an exploit exists).
- CVE-2022-25313 — Stack exhaustion when parsing the "doctype" (DTD) block, manifesting in files larger than 2 MB that contain a very large number of opening brackets. The vulnerability may be exploited for remote code execution in the system.
- CVE-2022-25315 — Integer overflow in the storeRawNames function, which occurs only on 64-bit systems and requires processing gigabytes of data. The vulnerability may be exploited for remote code execution in the system.
- CVE-2022-25314 — Integer overflow in the copyString function, which occurs only on 64-bit systems and requires processing gigabytes of data. This issue can lead to denial of service.
Source: opennet.ru
