Integer overflow in expat - CVE-2022-23852

Vulnerability identifier: #VU59966

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23852

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

expat
Gentoo Linux
Amazon Linux AMI
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
Red Hat Enterprise Linux for Scientific Computing
CentOS
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
IBM AIX
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Google Android
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Server
Oracle Solaris
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
Slackware Linux
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
Junos OS
openEuler
AFS670-V20
AFS66X-B
AFS660-C
AFS66X-S
AFF66X FW
AFR677
AFS67X
AFS65X
cflinuxfs3
Telemetry Dashboard
Liquidware
Citrix Workspace App
Webex App VDI
EMC ECS
XtremIO X2
Storage Protect for Virtual Environments: Data Protection for VMware
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
jbcs-httpd24-openssl-chil (Red Hat package)
jbcs-httpd24-brotli (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-apr (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-nghttp2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
expat (Debian package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
jbcs-httpd24-jansson (Red Hat package)
jbcs-httpd24-curl (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
lib64expat1 (Ubuntu package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
expat
libexpat1
libexpat1-32bit
expat-debuginfo
expat-debugsource
expat-devel
expat-static
expat (Red Hat package)
libexpat-devel
libexpat1-debuginfo-32bit
libexpat1-debuginfo
expat-debuginfo-32bit
libexpat1 (Ubuntu package)
libexpat1-32bit-debuginfo
expat-32bit-debuginfo
expat-help
dev-libs/expat
Red Hat OpenShift GitOps
IBM QRadar Network Security
IBM QRadar Network Packet Capture
Service Telemetry Framework
IBM Netezza Performance Portal
Red Hat Advanced Cluster Management for Kubernetes
Tenable Nessus
IBM Rational ClearCase
IBM Netezza Analytics for NPS
Netcool Operations Insight
IBM Tivoli Monitoring
Steel Belted Radius Carrier Edition
Migration Toolkit for Containers
IBM Netezza Analytics
Nessus Network Monitor
VMware Horizon Client
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
EMC ESRS Policy Manager
NetWorker Management Console
IBM Cloud Pak System
OpenShift Virtualization
Red Hat OpenShift Serverless
SecurID Authentication Manager
Cisco Jabber
Cisco Webex Meetings
JBoss Core Services
SINEMA Remote Connect Server
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
Juniper Junos Space
Contrail Networking

Install update from vendor's website.

expat - update to 2.4.4
cflinuxfs3 - update to 0.274.0
jbcs-httpd24-openssl-pkcs11 (Red Hat package) - addressed in versions 0.4.10-31.el7jbcs, 0.4.10-31.el8jbcs
jbcs-httpd24-openssl-chil (Red Hat package) - addressed in versions 1.0.0-16.el7jbcs, 1.0.0-16.el8jbcs
Telemetry Dashboard - update to 1.1.0.6 on Thin OS 2405
jbcs-httpd24-brotli (Red Hat package) - addressed in versions 1.0.9-2.el7jbcs, 1.0.9-2.el8jbcs
Red Hat OpenShift GitOps - addressed in versions 1.2.3, 1.3.6, 1.4.4
jbcs-httpd24-apr-util (Red Hat package) - addressed in versions 1.6.1-98.el7jbcs, 1.6.1-98.el8jbcs
jbcs-httpd24-apr (Red Hat package) - addressed in versions 1.7.0-6.el7jbcs, 1.7.0-6.el8jbcs
Migration Toolkit for Containers - addressed in versions 1.5.4, 1.7.1, 1.7.2
Cloud Pak for Security (CP4S) - update to 1.10.7.0
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.15.19-17.el7jbcs, 1.15.19-17.el8jbcs
jbcs-httpd24-nghttp2 (Red Hat package) - addressed in versions 1.43.0-10.el7jbcs, 1.43.0-10.el8jbcs
jbcs-httpd24-mod_md (Red Hat package) - addressed in versions 2.4.0-15.el7jbcs, 2.4.0-15.el8jbcs
IBM Netezza Performance Portal - update to 2.1.1.12
expat (Debian package) - addressed in versions 2.2.6-2+deb10u2, 2.2.10-2+deb11u1
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.3.8, 2.4.3
IBM Cloud Pak System - update to 2.3.3.5
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.51-28.el7jbcs, 2.4.51-28.el8jbcs
jbcs-httpd24-mod_security (Red Hat package) - addressed in versions 2.9.3-19.el7jbcs, 2.9.3-19.el8jbcs
jbcs-httpd24-jansson (Red Hat package) - addressed in versions 2.14-1.el7jbcs, 2.14-1.el8jbcs
IBM Netezza Analytics - update to 3.4.1
OpenShift Virtualization - update to 4.8.7
IBM QRadar Network Security - addressed in versions 5.4.0.16, 5.5.0.11
Nessus Network Monitor - update to 6.2.1
Liquidware - update to 6.7.0.2.2 on Thin OS 2405
IBM Qradar SIEM - addressed in versions 7.3.3 Fix Pack 12, 7.4.3 Fix Pack 6, 7.5.0 Update Pack 2
jbcs-httpd24-curl (Red Hat package) - addressed in versions 7.83.1-6.el7jbcs, 7.83.1-6.el8jbcs
Tenable Nessus - addressed in versions 8.15.3, 8.15.5, 10.1.1, 10.2.0
IBM Rational ClearCase - addressed in versions 9.0.1.14, 9.0.2.6, 9.1.0.3
SecurID Authentication Manager - update to 8.6 Patch 3
Google Android - addressed in versions 10 2022-09-01, 11 2022-09-01, 12L 2022-09-01, 12 2022-09-01
IBM Netezza Analytics for NPS - update to 11.2.25
Cisco Jabber - update to 14.3.0.308378.11 on Thin OS 2405
Junos OS - addressed in versions 12.3X48-D95, 12.3R12-S15, 13.2X51-D40, 14.1X53-D30, 14.1X53-D53, 15.1x49-D190, 15.1R7-S6, 16.1R7-S6, 16.2R3, 17.1R2-S11, 17.1R3-S1, 17.2R1-S9, 17.2R2-S8, 17.2R3-S3, 17.3R2-S5, 17.3R3-S6, 17.4R2-S7, 17.4R3, 18.1R3-S8, 18.2R2-S7, 18.2R3-S1, 18.3R1-S5, 18.3R2-S2, 18.3R3, 18.4R1-S4, 18.4R2-S1, 18.4R2-S10, 18.4R3, 18.4R3-S10, 19.1R1-S3, 19.1R2, 19.1R3-S7, 19.1R3-S9, 19.2R1-S1, 19.2R1-S8, 19.2R2, 19.2R3-S4, 19.3R1, 19.3R3-S4, 19.3R3-S6, 19.4R2-S6, 19.4R2-S7, 19.4R3-S6, 19.4R3-S9, 19.4R3-S10, 20.1R3-S3, 20.1R3-S4, 20.2R3-S3, 20.2R3-S5, 20.2R3-S6, 20.3R3-S3, 20.3R3-S4, 20.3R3-S6, 20.4R3, 20.4R3-S4, 20.4R3-S5, 20.4R3-S8, 21.1R2, 21.1R3-S3, 21.1R3-S4, 21.2R1, 21.2R3-S1, 21.2R3-S4, 21.2R3-S6, 21.3R3-S1, 21.3R3-S3, 21.3R3-S5, 21.4R2, 21.4R3-S1, 21.4R3-S4, 22.1R2, 22.1R2-S2, 22.1R3, 22.1R3-S3, 22.2R1, 22.2R2, 22.2R2-S1, 22.2R3, 22.2R3-S1, 22.3R1, 22.3R1-S1, 22.3R2, 22.3R2-S2, 22.3R3, 22.4R1, 22.4R2-S1, 22.4R3, 23.2R1
Citrix Workspace App - update to 24.2.0.65.17 on Thin OS 2405
Webex App VDI - update to 44.2.0.28744.1 on Thin OS 2405
Cisco Webex Meetings - update to 44.2.0.76.2 on Thin OS 2405
VMware Horizon Client - update to 2312.1.8.12.1.5 on Thin OS 2405
lib64expat1 (Ubuntu package) - update to UA Infra or UA Desktop
Red Hat OpenShift Serverless - update to 1
jbcs-httpd24-mod_proxy_cluster (Red Hat package) - addressed in versions 1.3.17-9.el7jbcs, 1.3.17-9.el8jbcs
Netcool Operations Insight - update to 1.6.6
expat - addressed in versions 2.0.1-88.42.15.1, 2.1.0-21.15.1, 2.2.5-3.12.1
libexpat1 - addressed in versions 2.0.1-88.42.15.1, 2.1.0-21.15.1, 2.2.5-3.12.1
libexpat1-32bit - addressed in versions 2.0.1-88.42.15.1, 2.1.0-21.15.1, 2.2.5-3.12.1
expat-debuginfo - addressed in versions 2.0.1-88.42.15.1, 2.1.0-21.15.1, 2.2.5-3.12.1
expat-debugsource - addressed in versions 2.0.1-88.42.15.1, 2.1.0-21.15.1, 2.2.5-3.12.1
expat-devel - addressed in versions 2.1.0-14, 2.2.5-4
expat-static - update to 2.1.0-14
expat - addressed in versions 2.1.0-14, 2.2.5-4
expat (Red Hat package) - addressed in versions 2.1.0-14.el7_9, 2.2.5-4.el8_4.3, 2.2.5-4.el8_5.3
libexpat-devel - addressed in versions 2.1.0-21.15.1, 2.2.5-3.12.1
libexpat1-debuginfo-32bit - update to 2.1.0-21.15.1
libexpat1-debuginfo - addressed in versions 2.1.0-21.15.1, 2.2.5-3.12.1
expat-debuginfo-32bit - update to 2.1.0-21.15.1
libexpat1 (Ubuntu package) - addressed in versions 2.2.5-3ubuntu0.4, 2.2.9-1ubuntu0.2, 2.4.1-2ubuntu0.1
libexpat1-32bit-debuginfo - update to 2.2.5-3.12.1
expat-32bit-debuginfo - update to 2.2.5-3.12.1
expat - update to 2.2.9-5
expat-devel - update to 2.2.9-5
expat-help - update to 2.2.9-5
expat-debuginfo - update to 2.2.9-5
expat-debugsource - update to 2.2.9-5
dev-libs/expat - update to 2.4.9
JBoss Core Services - update to 2.4.51
expat - update to 2.5.0-1
SINEMA Remote Connect Server - update to 3.1
EMC ECS - update to 3.7.0.2
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity Operating Environment (OE) - update to 5.2.0.0.5.173
EMC ESRS Policy Manager - update to 5.10.00.00
IBM Tivoli Monitoring - update to 6.3.0.7 Plus Service Pack 5
XtremIO X2 - update to 6.4.1-11
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.1.20.0
Steel Belted Radius Carrier Edition - update to 8.6.0R16
AFR677 - update to 09.1.08 FW
AFS67X - update to 09.1.08 FW
AFS65X - update to 09.1.08 FW
NetWorker Management Console - update to 19.12.0.1
Juniper Junos Space - update to 22.2R1
Contrail Networking - update to 2011.L5

• https://github.com/libexpat/libexpat/pull/550

• Remote code execution in libexpat
• Slackware Linux update for expat
• Multiple vulnerabilities in Tenable Nessus
• Debian update for expat
• Multiple vulnerabilities in cflinuxfs3
• Amazon Linux AMI update for expat
• Red Hat Enterprise Linux 8 update for expat
• Multiple vulnerabiltiies in IBM Netezza Performance Portal
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.2
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.4
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.3
• Red Hat Enterprise Linux 7 update for expat
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.3
• CentOS 7 update for expat
• Multiple vulnerabilities in Oracle Solaris
• Multiple vulnerabilities in IBM Netezza Analytics for NPS
• Multiple vulnerabilities in IBM Netezza Analytics
• Red Hat Enterprise Linux 8.4 Extended Update Support update for expat
• Multiple vulnerabilities in IBM Tivoli Monitoring
• Multiple vulnerabilities in Siemens SINEMA Remote Connect Server
• Multiple vulnerabilities in Tenable Nessus
• Ubuntu update for expat
• Multiple vulnerabilities in IBM QRadar Network Packet Capture
• Multiple vulnerabilities in Red Hat Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in IBM QRadar Network Security
• Multiple vulnerabilities in IBM Rational ClearCase
• IBM AIX update for Python
• Multiple vulnerabilities in Red Hat Service Telemetry Framework
• Multiple vulnerabilities in IBM Cloud Pak System third-party components
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Google Android
• Multiple vulnerabilities in Dell Elastic Cloud Storage (ECS)
• Multiple vulnerabilities in Dell EMC Policy Manager
• Gentoo update for Expat
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in Juniper Networks Contrail Networking
• Multiple vulnerabilities in Junos Space
• Multiple vulnerabilities in Juniper Networks Steel Belted Radius Carrier Edition
• Multiple vulnerabilities in Red Hat JBoss Core Services
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• SUSE update for expat
• SUSE update for expat
• SUSE update for expat
• Multiple vulnerabilities in Junos OS
• Multiple vulnerabilities in Nessus Network Monitor
• Multiple vulnerabilities in Dell XtremIO X2
• Multiple vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT
• Multiple vulnerabilities in Hitachi Energy AFS65x, AFF66x, AFS67x and AFR67x Series Products
• Multiple vulnerabilities in IBM Storage Protect for Virtual Environments: Data Protection for VMware
• openEuler update for expat
• Multiple vulnerabilities in Dell ThinOS
• Amazon Linux AMI update for expat
• Multiple vulnerabilities in Migration Toolkit for Containers 1.5
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.4
• Multiple vulnerabilities in Migration Toolkit for Containers 1.7
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Anolis OS update for expat
• Anolis OS update for expat
• SecurID Authentication Manager update for third-party components
• Dell NetWorker Management Console update for third-party components