PT-2022-1760 · Expat+12 · Expat+12

Fleimkeipa · Published 2022-01-08 · Updated 2026-04-01 · CVE-2022-22827

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Expat (aka libexpat) versions prior to 2.4.3

Description The issue is related to an integer overflow in the storeAtts function in xmlparse.c of the Expat library. This could allow a remote attacker to execute arbitrary code.

Recommendations For versions prior to 2.4.3, update to version 2.4.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the storeAtts function in xmlparse.c until a patch is available.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2022:0951

ALSA-2022:7692

ALT-PU-2022-1072

ALT-PU-2022-1130

ALT-PU-2022-1176

ALT-PU-2023-4107

AZL-7161

BDU:2022-01058

CESA-2022_0951

CESA-2022_1069

CESA-2022_7692

CLEANSTART-2026-EM10970

CLEANSTART-2026-MH09144

CLEANSTART-2026-YT18139

CVE-2022-22827

DLA-2904-1

DSA-5073-1

MGASA-2022-0031

OESA-2022-1490

OESA-2023-1464

OESA-2023-1465

OPENSUSE-SU-2022:0178-1

OPENSUSE-SU-2022_0178-1

OPENSUSE-SU-2024:11762-1

RHSA-2022:0951

RHSA-2022:1069

RHSA-2022:7692

RHSA-2022_0951

RHSA-2022_1069

RHSA-2022_7692

RLSA-2022:0951

RLSA-2022:7692

SUSE-SU-2022:0178-1

SUSE-SU-2022:0179-1

SUSE-SU-2022:14878-1

USN-5288-1

USN-5455-1

USN-7199-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Expat

Ibm Aix

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 219

• https://osv.dev/vulnerability/DLA-2904-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1490 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22827 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7199-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/676048 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-22827 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28757 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25315 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25236 · Security Note
• https://osv.dev/vulnerability/OESA-2023-1464 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-1283 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-22822 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15903 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:14878-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22827 · Security Note