Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / CVE-2022-25235

kritisch

CVE-2022-25235

expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution

Veröffentlicht Geändert CWE 116
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Amazon, CBL-Mariner, Julia, Photon OS. Niedriger laut Red Hat (hoch), AlmaLinux (hoch), Bottlerocket (hoch), Oracle (hoch), Rocky Linux (hoch), Ubuntu (hoch).

Beschreibung

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
amazon linux 1expat, expat-debuginfo, expat-devel und 7 weitere2.1.0-12.27.amzn1 und 1 weitere
amazon linux 2expat, expat-debuginfo, expat-devel und 10 weitere2.1.0-12.amzn2.0.3 und 2 weitere
amazon linux 2022expat, expat-debuginfo, expat-debugsource und 14 weitere2.4.7-1.amzn2022.0.1 und 1 weitere
amazon linux 2023expat, expat-debuginfo, expat-debugsource und 14 weitere2.5.0-1.amzn2023.0.2 und 1 weitere
CBL-Mariner 1.0expat0:2.4.6-1.cm1
CBL-Mariner 2.0expat0:2.4.8-1.cm2
julia::Julia Ecosystem Security AdvisoriesExpat_jll2.4.8+0
Photon OS 1.0expat2.2.9-6.ph1
Photon OS 2.0expat2.2.9-6.ph2
Photon OS 3.0expat2.2.9-7.ph3
Photon OS 4.0expat, expat-devel, expat-docs und 1 weitere2.2.9-7.ph4
alma 8expat, expat-devel, firefox und 6 weitere2.2.5-8.el8_6.2 und 4 weitere
Alle 195 Einträge aus 68 Quellen zeigen
QuellePaketBehoben in
amazon linux 1expat2.1.0-12.27.amzn1
amazon linux 1expat-debuginfo2.1.0-12.27.amzn1
amazon linux 1expat-devel2.1.0-12.27.amzn1
amazon linux 1xmlrpc-c1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-apps1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-c++1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-client1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-client++1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-debuginfo1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-devel1.22.04-r1934.7.amzn1
amazon linux 2expat2.1.0-12.amzn2.0.3
amazon linux 2expat-debuginfo2.1.0-12.amzn2.0.3
amazon linux 2expat-devel2.1.0-12.amzn2.0.3
amazon linux 2expat-static2.1.0-12.amzn2.0.3
amazon linux 2thunderbird91.7.0-2.amzn2.0.1
amazon linux 2thunderbird-debuginfo91.7.0-2.amzn2.0.1
amazon linux 2xmlrpc-c1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-apps1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-c++1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-client1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-client++1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-debuginfo1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-devel1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2022expat2.4.7-1.amzn2022.0.1
amazon linux 2022expat-debuginfo2.4.7-1.amzn2022.0.1
amazon linux 2022expat-debugsource2.4.7-1.amzn2022.0.1
amazon linux 2022expat-devel2.4.7-1.amzn2022.0.1
amazon linux 2022expat-static2.4.7-1.amzn2022.0.1
amazon linux 2022xmlrpc-c1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-apps1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-apps-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-c++1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-c++-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-client1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-client++1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-client++-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-client-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-debugsource1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-devel1.51.0-12.amzn2022.0.2
amazon linux 2023expat2.5.0-1.amzn2023.0.2
amazon linux 2023expat-debuginfo2.5.0-1.amzn2023.0.2
amazon linux 2023expat-debugsource2.5.0-1.amzn2023.0.2
amazon linux 2023expat-devel2.5.0-1.amzn2023.0.2
amazon linux 2023expat-static2.5.0-1.amzn2023.0.2
amazon linux 2023xmlrpc-c1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-apps1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-apps-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-c++1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-c++-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-client1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-client++1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-client++-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-client-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-debugsource1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-devel1.51.08-2.amzn2023.0.1
CBL-Mariner 1.0expat0:2.4.6-1.cm1
CBL-Mariner 2.0expat0:2.4.8-1.cm2
julia::Julia Ecosystem Security AdvisoriesExpat_jll2.4.8+0
Photon OS 1.0expat2.2.9-6.ph1
Photon OS 2.0expat2.2.9-6.ph2
Photon OS 3.0expat2.2.9-7.ph3
Photon OS 4.0expat2.2.9-7.ph4
Photon OS 4.0expat-devel2.2.9-7.ph4
Photon OS 4.0expat-docs2.2.9-7.ph4
Photon OS 4.0expat-libs2.2.9-7.ph4
alma 8expat2.2.5-8.el8_6.2
alma 8expat-devel2.2.5-8.el8_6.2
alma 8firefox91.7.0-3.el8_5.alma
alma 8mingw32-expat2.4.8-1.el8
alma 8mingw64-expat2.4.8-1.el8
alma 8thunderbird91.7.0-2.el8_5.alma
alma 8xmlrpc-c-c++1.51.0-5.el8_5.1
alma 8xmlrpc-c-client++1.51.0-5.el8_5.1
alma 8xmlrpc-c-devel1.51.0-5.el8_5.1
alpine 3.12expat2.2.10-r2
alpine 3.13expat2.2.10-r4
alpine 3.14expat2.4.5-r0
alpine 3.15expat2.4.5-r0
alpine 3.16expat2.4.5-r0
alpine 3.17expat2.4.5-r0
alpine 3.18expat2.4.5-r0
alpine 3.19expat2.4.5-r0
alpine 3.20expat2.4.5-r0
alpine 3.21expat2.4.5-r0
alpine 3.22expat2.4.5-r0
alpine 3.23expat2.4.5-r0
alpine 3.24expat2.4.5-r0
alpine edgeexpat2.4.5-r0
bottlerocketlibexpat1.7.0-bf3ca665
debian 10expat2.2.6-2+deb10u3
debian 11expat2.2.10-2+deb11u2
debian 11libxmltokkein Fix angegeben
debian 12expat2.4.5-1
debian 12libxmltokkein Fix angegeben
debian 13expat2.4.5-1
debian 14expat2.4.5-1
debian 9expat2.2.0-2+deb9u5
echoexpat2.4.5-1
echolibxmltokkein Fix angegeben
Oracle Linux 6expat2.0.1-13.0.1.el6_8
Oracle Linux 6expat-devel2.0.1-13.0.1.el6_8
Oracle Linux 7expat2.1.0-14.0.1.el7_9
Oracle Linux 7expat-devel2.1.0-14.0.1.el7_9
Oracle Linux 7expat-static2.1.0-14.0.1.el7_9
Oracle Linux 7firefox91.7.0-3.0.1.el7_9
Oracle Linux 7thunderbird91.7.0-2.0.1.el7_9
Oracle Linux 8expat2.2.5-4.el8_5.3
Oracle Linux 8expat-devel2.2.5-4.el8_5.3
Oracle Linux 8firefox91.7.0-3.0.1.el8_5
Oracle Linux 8thunderbird91.7.0-2.0.1.el8_5
Oracle Linux 8xmlrpc-c1.51.0-5.el8_5.1
Oracle Linux 8xmlrpc-c-c++1.51.0-5.el8_5.1
Oracle Linux 8xmlrpc-c-client1.51.0-5.el8_5.1
Oracle Linux 8xmlrpc-c-client++1.51.0-5.el8_5.1
Oracle Linux 8xmlrpc-c-devel1.51.0-5.el8_5.1
rapidfort debian 12libxmltok0:1.2-4.1
rapidfort debian 13libxmltok0:1.2-4.1
rapidfort ubuntu 20.04matanzakein Fix angegeben
rapidfort ubuntu 20.04swish-ekein Fix angegeben
rapidfort ubuntu 20.04thunderbirdkein Fix angegeben
rapidfort ubuntu 22.04matanzakein Fix angegeben
rapidfort ubuntu 22.04swish-ekein Fix angegeben
rapidfort ubuntu 22.04thunderbirdkein Fix angegeben
rapidfort ubuntu 24.04matanzakein Fix angegeben
rapidfort ubuntu 24.04swish-ekein Fix angegeben
rapidfort ubuntu 24.04thunderbirdkein Fix angegeben
Red Hatfirefox:flatpak::firefoxkein Fix angegeben
Red Hatthunderbird:flatpak::thunderbirdkein Fix angegeben
rocky 8expat2.2.5-4.el8_5.3
rocky 8expat-devel2.2.5-4.el8_5.3
rocky 8firefox91.7.0-3.el8_5
rocky 8thunderbird91.7.0-2.el8_5
rocky 8xmlrpc-c1.51.0-5.el8_5.1
rocky 8xmlrpc-c-client1.51.0-5.el8_5.1
root.io debian 11rootio-expat2.2.10-2+deb11u2
root.io debian 12rootio-expat2.4.5-1
root.io debian 13rootio-expat2.4.5-1
seal debianexpat2.2.10-2+deb11u5+sp999
seal debianseal-expat2.2.10-2+deb11u5+sp999
seal Red Hat 6expat2.0.1-15.el6_10+sp999
seal Red Hat 6seal-expat2.0.1-15.el6_10+sp999
seal Red Hat 7expat2.1.0-15.el7_9+sp999
seal Red Hat 7seal-expat2.1.0-15.el7_9+sp999
seal Red Hat 8expat2.2.5-16.el8_10+sp999, 2.2.5-4.0.1.el8_5.3+sp999
seal Red Hat 8seal-expat2.2.5-16.el8_10+sp999, 2.2.5-4.0.1.el8_5.3+sp999
ubuntu 14.04-ESMexpat2.1.0-4ubuntu1.4+esm4
ubuntu 16.04-ESMcoin33.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
ubuntu 16.04-ESMexpat2.1.0-7ubuntu0.16.04.5+esm2
ubuntu 16.04-ESMinsighttoolkit3.20.1+git20120521-6ubuntu0.1~esm1
ubuntu 16.04-ESMlibxmltok1.2-3ubuntu0.16.04.1~esm2
ubuntu 16.04-ESMswish-e2.4.7-4ubuntu0.1~esm1
ubuntu 18.04expat2.2.5-3ubuntu0.4
ubuntu 18.04-ESMcoin33.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
ubuntu 18.04-ESMexpat2.2.5-3ubuntu0.4
ubuntu 18.04-ESMlibxmltok1.2-4ubuntu0.18.04.1~esm1
ubuntu 18.04-ESMswish-e2.4.7-5ubuntu1+esm1
ubuntu 18.04-ESMxmlrpc-c1.33.14-8ubuntu0.18.04.1~esm1
ubuntu 20.04expat2.2.9-1ubuntu0.2
ubuntu 20.04-ESMexpat2.2.9-1ubuntu0.2
ubuntu 20.04-ESMlibxmltok1.2-4ubuntu0.20.04.1~esm1
ubuntu 20.04-ESMswish-e2.4.7-6ubuntu0.1~esm1
ubuntu 20.04-ESMxmlrpc-c1.33.14-8ubuntu0.20.04.1~esm1
ubuntu 21.10expat2.4.1-2ubuntu0.1
ubuntu 22.04expat2.4.5-2
ubuntu 22.04firefox1:1snap1-0ubuntu1
ubuntu 22.04libxmltokkein Fix angegeben
ubuntu 22.04swish-ekein Fix angegeben
ubuntu 22.04xmlrpc-ckein Fix angegeben
ubuntu 22.10expat2.4.5-2
ubuntu 22.10firefox1:1snap1-0ubuntu1
ubuntu 23.04expat2.4.5-2
ubuntu 23.04firefox1:1snap1-0ubuntu1
ubuntu 23.10expat2.4.5-2
ubuntu 23.10firefox1:1snap1-0ubuntu1
ubuntu 24.04expat2.4.5-2
ubuntu 24.04firefox1:1snap1-0ubuntu1
ubuntu 24.04libxmltok1.2-4.1ubuntu1
ubuntu 24.04swish-ekein Fix angegeben
ubuntu 24.04xmlrpc-ckein Fix angegeben
ubuntu 24.10expat2.4.5-2
ubuntu 24.10firefox1:1snap1-0ubuntu1
ubuntu 24.10libxmltok1.2-4.1ubuntu1
ubuntu 25.04expat2.4.5-2
ubuntu 25.04firefox1:1snap1-0ubuntu1
ubuntu 25.04libxmltok1.2-4.1ubuntu1
ubuntu 25.10expat2.4.5-2
ubuntu 25.10firefox1:1snap1-0ubuntu1
ubuntu 26.04expat2.4.5-2
ubuntu 26.04firefox1:1snap1-0ubuntu1
ubuntu 26.04swish-ekein Fix angegeben
ubuntu 26.10expat2.4.5-2
ubuntu 26.10firefox1:1snap1-0ubuntu1
ubuntu 26.10swish-ekein Fix angegeben

Referenzen

Alle 42 Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.