CVE-2022-23990
Published: 26 January 2022
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
Notes
| Author | Note |
|---|---|
| sbeattie | paraview uses system expat xotcl uses system expat poco uses system expat gdcm uses system expat audacity uses system expat simgear uses system expat coin3 uses system expat as of 4.0.0~CMake~6f54f1602475+ds1-1 sitecopy uses system expat since 1:0.16.0-1 (dapper!) |
| rodrigo-zaiden | libxmltok does not include in_eldec in dtd, so, it is not affected. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
apache2 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code-not-compiled)
|
| focal |
Not vulnerable
(code-not-compiled)
|
|
| impish |
Not vulnerable
(code-not-compiled)
|
|
| trusty |
Not vulnerable
(code-not-compiled)
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code-not-compiled)
|
|
| jammy |
Not vulnerable
(code-not-compiled)
|
|
| kinetic |
Not vulnerable
(code-not-compiled)
|
|
| lunar |
Not vulnerable
(code-not-compiled)
|
|
| mantic |
Not vulnerable
(code-not-compiled)
|
|
|
apr-util Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code-not-compiled)
|
| focal |
Not vulnerable
(code-not-compiled)
|
|
| impish |
Not vulnerable
(code-not-compiled)
|
|
| trusty |
Not vulnerable
(code-not-compiled)
|
|
| jammy |
Not vulnerable
(code-not-compiled)
|
|
| kinetic |
Not vulnerable
(code-not-compiled)
|
|
| lunar |
Not vulnerable
(code-not-compiled)
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code-not-compiled)
|
|
| mantic |
Not vulnerable
(code-not-compiled)
|
|
|
insighttoolkit Launchpad, Ubuntu, Debian |
trusty |
Does not exist
|
| bionic |
Does not exist
|
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code not present)
|
|
| mantic |
Does not exist
|
|
|
swish-e Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code not present)
|
| focal |
Not vulnerable
(code not present)
|
|
| impish |
Not vulnerable
(code not present)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code not present)
|
|
| kinetic |
Ignored
(end of life, was needs-triage)
|
|
| jammy |
Needs triage
|
|
| lunar |
Needs triage
|
|
| mantic |
Needs triage
|
|
|
matanza Launchpad, Ubuntu, Debian |
xenial |
Needed
|
| kinetic |
Ignored
(end of life, was needs-triage)
|
|
| bionic |
Needed
|
|
| focal |
Needed
|
|
| impish |
Ignored
(end of life)
|
|
| jammy |
Needs triage
|
|
| lunar |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| mantic |
Needs triage
|
|
|
tdom Launchpad, Ubuntu, Debian |
xenial |
Needed
|
| bionic |
Needed
|
|
| focal |
Needed
|
|
| kinetic |
Ignored
(end of life, was needs-triage)
|
|
| impish |
Ignored
(end of life)
|
|
| jammy |
Needs triage
|
|
| lunar |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| mantic |
Needs triage
|
|
|
vtk Launchpad, Ubuntu, Debian |
trusty |
Not vulnerable
(code not present)
|
| bionic |
Does not exist
|
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code not present)
|
|
| mantic |
Does not exist
|
|
|
expat Launchpad, Ubuntu, Debian |
bionic |
Released
(2.2.5-3ubuntu0.4)
|
| focal |
Released
(2.2.9-1ubuntu0.2)
|
|
| impish |
Released
(2.4.1-2ubuntu0.1)
|
|
| trusty |
Released
(2.1.0-4ubuntu1.4+esm4)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| xenial |
Released
(2.1.0-7ubuntu0.16.04.5+esm2)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| jammy |
Released
(2.4.3-3)
|
|
| kinetic |
Released
(2.4.3-3)
|
|
| lunar |
Released
(2.4.3-3)
|
|
| upstream |
Needs triage
|
|
| mantic |
Released
(2.4.3-3)
|
|
|
Patches: upstream: https://github.com/libexpat/libexpat/pull/551/commits/ede41d1e186ed2aba88a06e84cac839b770af3a1 |
||
|
wbxml2 Launchpad, Ubuntu, Debian |
xenial |
Needed
|
| bionic |
Needed
|
|
| kinetic |
Ignored
(end of life, was needs-triage)
|
|
| focal |
Needed
|
|
| impish |
Ignored
(end of life)
|
|
| jammy |
Needs triage
|
|
| lunar |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| mantic |
Needs triage
|
|
|
ayttm Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code not present)
|
|
| mantic |
Does not exist
|
|
|
cableswig Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code not present)
|
|
| mantic |
Does not exist
|
|
|
cadaver Launchpad, Ubuntu, Debian |
kinetic |
Ignored
(end of life, was needs-triage)
|
| bionic |
Not vulnerable
(code not present)
|
|
| focal |
Not vulnerable
(code not present)
|
|
| impish |
Not vulnerable
(code not present)
|
|
| jammy |
Needs triage
|
|
| lunar |
Needs triage
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code not present)
|
|
| mantic |
Needs triage
|
|
|
cmake Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code-not-compiled)
|
| focal |
Not vulnerable
(code-not-compiled)
|
|
| impish |
Not vulnerable
(code-not-compiled)
|
|
| jammy |
Not vulnerable
(code-not-compiled)
|
|
| kinetic |
Not vulnerable
(code-not-compiled)
|
|
| lunar |
Not vulnerable
(code-not-compiled)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code-not-compiled)
|
|
| mantic |
Not vulnerable
(code-not-compiled)
|
|
|
coin3 Launchpad, Ubuntu, Debian |
bionic |
Needed
|
| focal |
Not vulnerable
(uses system expat)
|
|
| impish |
Not vulnerable
(uses system expat)
|
|
| jammy |
Not vulnerable
(uses system expat)
|
|
| kinetic |
Not vulnerable
(uses system expat)
|
|
| lunar |
Not vulnerable
(uses system expat)
|
|
| trusty |
Needed
|
|
| upstream |
Needs triage
|
|
| xenial |
Needed
|
|
| mantic |
Not vulnerable
(uses system expat)
|
|
|
firefox Launchpad, Ubuntu, Debian |
focal |
Ignored
(bundled deps handled by upstream in new versions)
|
| impish |
Ignored
(end of life)
|
|
| jammy |
Released
(1:1snap1-0ubuntu1)
|
|
| kinetic |
Released
(1:1snap1-0ubuntu1)
|
|
| lunar |
Released
(1:1snap1-0ubuntu1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| bionic |
Ignored
(end of standard support, was needed)
|
|
| xenial |
Ignored
(end of standard support, was needed)
|
|
| mantic |
Released
(1:1snap1-0ubuntu1)
|
|
|
gdcm Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(uses system expat)
|
| focal |
Not vulnerable
(uses system expat)
|
|
| impish |
Not vulnerable
(uses system expat)
|
|
| jammy |
Not vulnerable
(uses system expat)
|
|
| kinetic |
Not vulnerable
(uses system expat)
|
|
| lunar |
Not vulnerable
(uses system expat)
|
|
| trusty |
Not vulnerable
(uses system expat)
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(uses system expat)
|
|
| mantic |
Not vulnerable
(uses system expat)
|
|
|
ghostscript Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code-not-compiled)
|
| focal |
Not vulnerable
(code-not-compiled)
|
|
| impish |
Not vulnerable
(code-not-compiled)
|
|
| jammy |
Not vulnerable
(code-not-compiled)
|
|
| kinetic |
Not vulnerable
(code-not-compiled)
|
|
| lunar |
Not vulnerable
(code-not-compiled)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code-not-compiled)
|
|
| mantic |
Not vulnerable
(code-not-compiled)
|
|
|
insighttoolkit4 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(uses system expat)
|
| focal |
Not vulnerable
(uses system expat)
|
|
| jammy |
Not vulnerable
(uses system expat)
|
|
| kinetic |
Not vulnerable
(uses system expat)
|
|
| lunar |
Not vulnerable
(uses system expat)
|
|
| impish |
Not vulnerable
(code not present)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code not present)
|
|
| mantic |
Does not exist
|
|
|
libxmltok Launchpad, Ubuntu, Debian |
kinetic |
Not vulnerable
(code not present)
|
| lunar |
Not vulnerable
(code not present)
|
|
| bionic |
Not vulnerable
(code not present)
|
|
| focal |
Not vulnerable
(code not present)
|
|
| hirsute |
Ignored
(end of life)
|
|
| impish |
Not vulnerable
(code not present)
|
|
| jammy |
Not vulnerable
(code not present)
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code not present)
|
|
| mantic |
Not vulnerable
(code not present)
|
|
|
smart Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code-not-compiled)
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code-not-compiled)
|
|
| mantic |
Does not exist
|
|
|
texlive-bin Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code-not-compiled)
|
| focal |
Not vulnerable
(code-not-compiled)
|
|
| impish |
Not vulnerable
(code-not-compiled)
|
|
| jammy |
Not vulnerable
(code-not-compiled)
|
|
| kinetic |
Not vulnerable
(code-not-compiled)
|
|
| lunar |
Not vulnerable
(code-not-compiled)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code-not-compiled)
|
|
| mantic |
Not vulnerable
(code-not-compiled)
|
|
|
thunderbird Launchpad, Ubuntu, Debian |
kinetic |
Ignored
(end of life, was needs-triage)
|
| focal |
Ignored
(bundled deps handled by upstream in new versions)
|
|
| jammy |
Ignored
(bundled deps handled by upstream in new versions)
|
|
| lunar |
Ignored
(bundled deps handled by upstream in new versions)
|
|
| impish |
Ignored
(end of life)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| bionic |
Ignored
(end of standard support, was needed)
|
|
| xenial |
Ignored
(end of standard support, was needed)
|
|
| mantic |
Ignored
(bundled deps handled by upstream in new versions)
|
|
|
vnc4 Launchpad, Ubuntu, Debian |
bionic |
Not vulnerable
(code not present)
|
| focal |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| lunar |
Does not exist
|
|
| trusty |
Not vulnerable
(code not present)
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code not present)
|
|
| mantic |
Does not exist
|
|
|
xmlrpc-c Launchpad, Ubuntu, Debian |
kinetic |
Ignored
(end of life, was needs-triage)
|
| bionic |
Not vulnerable
(code not present)
|
|
| focal |
Not vulnerable
(code not present)
|
|
| impish |
Not vulnerable
(code not present)
|
|
| jammy |
Needs triage
|
|
| lunar |
Needs triage
|
|
| trusty |
Not vulnerable
(code not present)
|
|
| upstream |
Needs triage
|
|
| xenial |
Not vulnerable
(code not present)
|
|
| mantic |
Needs triage
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |