CVE-2022-40674High· 8.1▾ Twilightlibexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.2%
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
libexpat < 2.4.9debian_linux = 10.0debian_linux = 11.0fedora = 35fedora = 36fedora = 37Upgrade past the affected range:
libexpat 2.4.9Connected by shared product, vendor, weakness, or advisory.
CVE-2022-43680High· 7.5In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.
CVE-2022-25315Critical· 9.8In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
CVE-2022-25236Critical· 9.8xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
CVE-2022-25313Medium· 6.5In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
CVE-2022-25314High· 7.5In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
CVE-2022-23990High· 7.5Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.