CVE-2022-22822
Published: 10 January 2022
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Priority
Medium
CVSS 3 base score: 9.8
Status
| Package | Release | Status |
|---|---|---|
|
apache2 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code-not-compiled)
|
| focal |
Not vulnerable
(code-not-compiled)
|
|
| hirsute |
Not vulnerable
(code-not-compiled)
|
|
| impish |
Not vulnerable
(code-not-compiled)
|
|
| jammy |
Not vulnerable
(code-not-compiled)
|
|
| trusty |
Not vulnerable
(code-not-compiled)
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code-not-compiled)
|
|
|
apr-util Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code-not-compiled)
|
| focal |
Not vulnerable
(code-not-compiled)
|
|
| hirsute |
Not vulnerable
(code-not-compiled)
|
|
| impish |
Not vulnerable
(code-not-compiled)
|
|
| jammy |
Not vulnerable
(code-not-compiled)
|
|
| trusty |
Not vulnerable
(code-not-compiled)
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code-not-compiled)
|
|
|
ayttm Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
cableswig Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
cadaver Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Needs triage
|
|
| jammy |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
cmake Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code-not-compiled)
|
| focal |
Not vulnerable
(code-not-compiled)
|
|
| hirsute |
Not vulnerable
(code-not-compiled)
|
|
| impish |
Not vulnerable
(code-not-compiled)
|
|
| jammy |
Not vulnerable
(code-not-compiled)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code-not-compiled)
|
|
|
coin3 Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Not vulnerable
(uses system expat)
|
|
| hirsute |
Not vulnerable
(uses system expat)
|
|
| impish |
Not vulnerable
(uses system expat)
|
|
| jammy |
Not vulnerable
(uses system expat)
|
|
| trusty |
Needs triage
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
expat Launchpad, Ubuntu, Debian |
bionic |
Released
(2.2.5-3ubuntu0.4)
|
| focal |
Released
(2.2.9-1ubuntu0.2)
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Released
(2.4.1-2ubuntu0.1)
|
|
| jammy |
Released
(2.4.3-1)
|
|
| trusty |
Released
(2.1.0-4ubuntu1.4+esm4)
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(2.1.0-7ubuntu0.16.04.5+esm2)
|
|
|
firefox Launchpad, Ubuntu, Debian |
bionic |
Released
(98.0+build3-0ubuntu0.18.04.2)
|
| focal |
Released
(98.0+build3-0ubuntu0.20.04.2)
|
|
| impish |
Released
(98.0+build3-0ubuntu0.21.10.2)
|
|
| jammy |
Released
(1:1snap1-0ubuntu1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Released
(98)
|
|
| xenial |
Needs triage
|
|
|
gdcm Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(uses system expat)
|
| focal |
Not vulnerable
(uses system expat)
|
|
| hirsute |
Not vulnerable
(uses system expat)
|
|
| impish |
Not vulnerable
(uses system expat)
|
|
| jammy |
Not vulnerable
(uses system expat)
|
|
| trusty |
Not vulnerable
(uses system expat)
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(uses system expat)
|
|
|
ghostscript Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code-not-compiled)
|
| focal |
Not vulnerable
(code-not-compiled)
|
|
| hirsute |
Not vulnerable
(code-not-compiled)
|
|
| impish |
Not vulnerable
(code-not-compiled)
|
|
| jammy |
Not vulnerable
(code-not-compiled)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code-not-compiled)
|
|
|
insighttoolkit Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
insighttoolkit4 Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Needs triage
|
|
| jammy |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
matanza Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Needs triage
|
|
| jammy |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
smart Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code-not-compiled)
|
| focal |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code-not-compiled)
|
|
|
swish-e Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Needs triage
|
|
| jammy |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
tdom Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Needs triage
|
|
| jammy |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
texlive-bin Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code-not-compiled)
|
| focal |
Not vulnerable
(code-not-compiled)
|
|
| hirsute |
Not vulnerable
(code-not-compiled)
|
|
| impish |
Not vulnerable
(code-not-compiled)
|
|
| jammy |
Not vulnerable
(code-not-compiled)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code-not-compiled)
|
|
|
thunderbird Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Needs triage
|
|
| jammy |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Needs triage
|
|
|
vnc4 Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| trusty |
Needs triage
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
vtk Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| trusty |
Needs triage
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
wbxml2 Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Needs triage
|
|
| jammy |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
|
|
xmlrpc-c Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
| focal |
Needs triage
|
|
| hirsute |
Ignored
(reached end-of-life)
|
|
| impish |
Needs triage
|
|
| jammy |
Needs triage
|
|
| trusty |
Needs triage
|
|
| upstream |
Needs triage
|
|
| xenial |
Ignored
(end of standard support, was needs-triage)
|
Notes
| Author | Note |
|---|---|
| sbeattie | paraview uses system expat xotcl uses system expat poco uses system expat gdcm uses system expat audacity uses system expat simgear uses system expat coin3 uses system expat as of 4.0.0~CMake~6f54f1602475+ds1-1 sitecopy uses system expat since 1:0.16.0-1 (dapper!) |
| leosilva | CVE-2022-22822 to CVE-2022-22827 has the same fix/patch. |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22822
- https://github.com/libexpat/libexpat/pull/539
- https://ubuntu.com/security/notices/USN-5288-1
- NVD
- Launchpad
- Debian