CVE-2022-43680High· 7.5▾ MidnightPoC availableIn libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.5%
2 GitHub repos (last check)
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.
libexpat <= 2.4.9debian_linux = 10.0debian_linux = 11.0fedora = 35fedora = 36fedora = 37h300s_firmwareh500s_firmwareh700s_firmwareh410s_firmwareh410c_firmwareactive_iq_unified_manageroncommand_workflow_automationsolidfire_&_hci_management_nodehci_compute_node_firmwareRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-40674High· 8.1libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
CVE-2022-43552Medium· 5.9A use after free vulnerability exists in curl <7.87.0
CVE-2022-25315Critical· 9.8In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
CVE-2022-25236Critical· 9.8xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
CVE-2022-25313Medium· 6.5In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
CVE-2022-25314High· 7.5In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.