Most recent entries from all

ALSA-2022:0818 — Critical: firefox security update

Affected: AlmaLinux:8: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 91.7.0 ESR.

Security Fix(es):

* Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)

* Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)

* expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

* expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)

* expat: Integer overflow in storeRawNames() (CVE-2022-25315)

* Mozilla: Use-after-free in text reflows (CVE-2022-26381)

* Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)

* Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)

* Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)

* Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-01065

Withdrawn: BELL-CVE-2022-25236 — CVE-2022-25236 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2022-avi-201 — De multiples vulnérabilités ont été découvertes dans IBM WebSphere. Elles permettent à un attaquant de provoquer une ex…

certfr-2022-avi-201

CLEANSTART-2026-AU70614 — Security fix for CVE-2022-25236 applied in: expat 2.4.5-r0

Affected: CleanStart: expat

Security vulnerability affects the expat package. This issue is resolved in later releases. See references for vulnerability details.

cnvd-2022-18357

EUVD-2026-237354

fkie_cve-2022-25236

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

GHSA-3c6c-gjpg-qq92

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

gsd-2022-25236

ICSA-22-167-17 — Siemens OpenSSL Affecting Industrial Products

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse, if one of them matches the setup. Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*, which could lead to libcurl reusing wrong connections. File paths are, or can be, case sensitive on many systems but not all, and can even vary depending on used file systems. The comparison also didn't include the 'issuer cert' which a transfer can set to qualify how to verify the server certificate. curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending `NEW_ENV` variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. This could happen because curl did not call and use sscanf() correctly when parsing the string provided by the application. In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. addBinding in xmlparse.c in Exp…

msrc_CVE-2022-25236 — xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…

msrc_CVE-2022-25236

OESA-2022-1554 — expat security update

Affected: openEuler:20.03-LTS-SP1: expat, openEuler:20.03-LTS-SP2: expat, openEuler:20.03-LTS-SP3: expat

An XML parser library. Security Fix(es): xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.(CVE-2022-25235) xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.(CVE-2022-25236) In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.(CVE-2022-25314) In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.(CVE-2022-25313) In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.(CVE-2022-25315)

openSUSE-SU-2022:0713-1 — Security update for expat

Security update for expat

RHSA-2022:0815 — Red Hat Security Advisory: firefox security update

expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution expat: Integer overflow in storeRawNames() Mozilla: Use-after-free in text reflows Mozilla: Browser window spoof using fullscreen mode Mozilla: iframe allow-scripts sandbox bypass Mozilla: Temporary files downloaded to /tmp and accessible by other local users Mozilla: Time-of-check time-of-use bug when verifying add-on signatures Mozilla: Use-after-free in XSLT parameter processing Mozilla: Use-after-free in WebGPU IPC Framework

SUSE-SU-2022:0698-1 — Security update for expat

Security update for expat

UBUNTU-CVE-2022-25236

Affected: Ubuntu:Pro:14.04:LTS: expat, Ubuntu:Pro:14.04:LTS: coin3, Ubuntu:Pro:14.04:LTS: xmlrpc-c, Ubuntu:Pro:16.04:LTS: expat, Ubuntu:Pro:16.04:LTS: coin3, Ubuntu:Pro:16.04:LTS: insighttoolkit, Ubuntu:Pro:16.04:LTS: libxmltok, Ubuntu:Pro:16.04:LTS: swish-e, Ubuntu:Pro:16.04:LTS: ayttm, Ubuntu:Pro:16.04:LTS: cableswig and 32 more

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

VDE-2022-005 — PHOENIX CONTACT: Vulnerabilities in XML parser library Expat (libexpat)

Several vulnerabilities have been discovered in the Expat XML parser library (aka libexpat).This open-source component is widely used in a lot of products worldwide.A remote, anonymous attacker could use an integer overflow to execute arbitrary program code when loading specially crafted XML files. Profinet SDK is using XML parser library Expat as reference solution for loading the XML based Profinet network configuration files (IPPNIO or TIC).

WID-SEC-W-2022-0062 — expat: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Ein Angreifer kann mehrere Schwachstellen in expat ausnutzen, um Sicherheitsvorkehrungen zu umgehen.