Attestkeep
Idioma: Español
Registrarse

Vulnerabilidades / CVE-2022-25235

crítica

CVE-2022-25235

expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution

Publicada Modificada CWE 116
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Julia9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Amazon, CBL-Mariner, Julia, Photon OS. Más baja según Red Hat (alta), AlmaLinux (alta), Bottlerocket (alta), Oracle (alta), Rocky Linux (alta), Ubuntu (alta).

Descripción

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

Paquetes afectados y versiones corregidas

FuentePaqueteCorregido en
amazon linux 1expat, expat-debuginfo, expat-devel y 7 más2.1.0-12.27.amzn1 y 1 más
amazon linux 2expat, expat-debuginfo, expat-devel y 10 más2.1.0-12.amzn2.0.3 y 2 más
amazon linux 2022expat, expat-debuginfo, expat-debugsource y 14 más2.4.7-1.amzn2022.0.1 y 1 más
amazon linux 2023expat, expat-debuginfo, expat-debugsource y 14 más2.5.0-1.amzn2023.0.2 y 1 más
CBL-Mariner 1.0expat0:2.4.6-1.cm1
CBL-Mariner 2.0expat0:2.4.8-1.cm2
julia::Julia Ecosystem Security AdvisoriesExpat_jll2.4.8+0
Photon OS 1.0expat2.2.9-6.ph1
Photon OS 2.0expat2.2.9-6.ph2
Photon OS 3.0expat2.2.9-7.ph3
Photon OS 4.0expat, expat-devel, expat-docs y 1 más2.2.9-7.ph4
alma 8expat, expat-devel, firefox y 6 más2.2.5-8.el8_6.2 y 4 más
Mostrar las 195 entradas de 68 fuentes
FuentePaqueteCorregido en
amazon linux 1expat2.1.0-12.27.amzn1
amazon linux 1expat-debuginfo2.1.0-12.27.amzn1
amazon linux 1expat-devel2.1.0-12.27.amzn1
amazon linux 1xmlrpc-c1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-apps1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-c++1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-client1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-client++1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-debuginfo1.22.04-r1934.7.amzn1
amazon linux 1xmlrpc-c-devel1.22.04-r1934.7.amzn1
amazon linux 2expat2.1.0-12.amzn2.0.3
amazon linux 2expat-debuginfo2.1.0-12.amzn2.0.3
amazon linux 2expat-devel2.1.0-12.amzn2.0.3
amazon linux 2expat-static2.1.0-12.amzn2.0.3
amazon linux 2thunderbird91.7.0-2.amzn2.0.1
amazon linux 2thunderbird-debuginfo91.7.0-2.amzn2.0.1
amazon linux 2xmlrpc-c1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-apps1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-c++1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-client1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-client++1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-debuginfo1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2xmlrpc-c-devel1.32.5-1905.svn2451.amzn2.0.2
amazon linux 2022expat2.4.7-1.amzn2022.0.1
amazon linux 2022expat-debuginfo2.4.7-1.amzn2022.0.1
amazon linux 2022expat-debugsource2.4.7-1.amzn2022.0.1
amazon linux 2022expat-devel2.4.7-1.amzn2022.0.1
amazon linux 2022expat-static2.4.7-1.amzn2022.0.1
amazon linux 2022xmlrpc-c1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-apps1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-apps-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-c++1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-c++-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-client1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-client++1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-client++-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-client-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-debuginfo1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-debugsource1.51.0-12.amzn2022.0.2
amazon linux 2022xmlrpc-c-devel1.51.0-12.amzn2022.0.2
amazon linux 2023expat2.5.0-1.amzn2023.0.2
amazon linux 2023expat-debuginfo2.5.0-1.amzn2023.0.2
amazon linux 2023expat-debugsource2.5.0-1.amzn2023.0.2
amazon linux 2023expat-devel2.5.0-1.amzn2023.0.2
amazon linux 2023expat-static2.5.0-1.amzn2023.0.2
amazon linux 2023xmlrpc-c1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-apps1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-apps-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-c++1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-c++-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-client1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-client++1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-client++-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-client-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-debuginfo1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-debugsource1.51.08-2.amzn2023.0.1
amazon linux 2023xmlrpc-c-devel1.51.08-2.amzn2023.0.1
CBL-Mariner 1.0expat0:2.4.6-1.cm1
CBL-Mariner 2.0expat0:2.4.8-1.cm2
julia::Julia Ecosystem Security AdvisoriesExpat_jll2.4.8+0
Photon OS 1.0expat2.2.9-6.ph1
Photon OS 2.0expat2.2.9-6.ph2
Photon OS 3.0expat2.2.9-7.ph3
Photon OS 4.0expat2.2.9-7.ph4
Photon OS 4.0expat-devel2.2.9-7.ph4
Photon OS 4.0expat-docs2.2.9-7.ph4
Photon OS 4.0expat-libs2.2.9-7.ph4
alma 8expat2.2.5-8.el8_6.2
alma 8expat-devel2.2.5-8.el8_6.2
alma 8firefox91.7.0-3.el8_5.alma
alma 8mingw32-expat2.4.8-1.el8
alma 8mingw64-expat2.4.8-1.el8
alma 8thunderbird91.7.0-2.el8_5.alma
alma 8xmlrpc-c-c++1.51.0-5.el8_5.1
alma 8xmlrpc-c-client++1.51.0-5.el8_5.1
alma 8xmlrpc-c-devel1.51.0-5.el8_5.1
alpine 3.12expat2.2.10-r2
alpine 3.13expat2.2.10-r4
alpine 3.14expat2.4.5-r0
alpine 3.15expat2.4.5-r0
alpine 3.16expat2.4.5-r0
alpine 3.17expat2.4.5-r0
alpine 3.18expat2.4.5-r0
alpine 3.19expat2.4.5-r0
alpine 3.20expat2.4.5-r0
alpine 3.21expat2.4.5-r0
alpine 3.22expat2.4.5-r0
alpine 3.23expat2.4.5-r0
alpine 3.24expat2.4.5-r0
alpine edgeexpat2.4.5-r0
bottlerocketlibexpat1.7.0-bf3ca665
debian 10expat2.2.6-2+deb10u3
debian 11expat2.2.10-2+deb11u2
debian 11libxmltoksin corrección indicada
debian 12expat2.4.5-1
debian 12libxmltoksin corrección indicada
debian 13expat2.4.5-1
debian 14expat2.4.5-1
debian 9expat2.2.0-2+deb9u5
echoexpat2.4.5-1
echolibxmltoksin corrección indicada
Oracle Linux 6expat2.0.1-13.0.1.el6_8
Oracle Linux 6expat-devel2.0.1-13.0.1.el6_8
Oracle Linux 7expat2.1.0-14.0.1.el7_9
Oracle Linux 7expat-devel2.1.0-14.0.1.el7_9
Oracle Linux 7expat-static2.1.0-14.0.1.el7_9
Oracle Linux 7firefox91.7.0-3.0.1.el7_9
Oracle Linux 7thunderbird91.7.0-2.0.1.el7_9
Oracle Linux 8expat2.2.5-4.el8_5.3
Oracle Linux 8expat-devel2.2.5-4.el8_5.3
Oracle Linux 8firefox91.7.0-3.0.1.el8_5
Oracle Linux 8thunderbird91.7.0-2.0.1.el8_5
Oracle Linux 8xmlrpc-c1.51.0-5.el8_5.1
Oracle Linux 8xmlrpc-c-c++1.51.0-5.el8_5.1
Oracle Linux 8xmlrpc-c-client1.51.0-5.el8_5.1
Oracle Linux 8xmlrpc-c-client++1.51.0-5.el8_5.1
Oracle Linux 8xmlrpc-c-devel1.51.0-5.el8_5.1
rapidfort debian 12libxmltok0:1.2-4.1
rapidfort debian 13libxmltok0:1.2-4.1
rapidfort ubuntu 20.04matanzasin corrección indicada
rapidfort ubuntu 20.04swish-esin corrección indicada
rapidfort ubuntu 20.04thunderbirdsin corrección indicada
rapidfort ubuntu 22.04matanzasin corrección indicada
rapidfort ubuntu 22.04swish-esin corrección indicada
rapidfort ubuntu 22.04thunderbirdsin corrección indicada
rapidfort ubuntu 24.04matanzasin corrección indicada
rapidfort ubuntu 24.04swish-esin corrección indicada
rapidfort ubuntu 24.04thunderbirdsin corrección indicada
Red Hatfirefox:flatpak::firefoxsin corrección indicada
Red Hatthunderbird:flatpak::thunderbirdsin corrección indicada
rocky 8expat2.2.5-4.el8_5.3
rocky 8expat-devel2.2.5-4.el8_5.3
rocky 8firefox91.7.0-3.el8_5
rocky 8thunderbird91.7.0-2.el8_5
rocky 8xmlrpc-c1.51.0-5.el8_5.1
rocky 8xmlrpc-c-client1.51.0-5.el8_5.1
root.io debian 11rootio-expat2.2.10-2+deb11u2
root.io debian 12rootio-expat2.4.5-1
root.io debian 13rootio-expat2.4.5-1
seal debianexpat2.2.10-2+deb11u5+sp999
seal debianseal-expat2.2.10-2+deb11u5+sp999
seal Red Hat 6expat2.0.1-15.el6_10+sp999
seal Red Hat 6seal-expat2.0.1-15.el6_10+sp999
seal Red Hat 7expat2.1.0-15.el7_9+sp999
seal Red Hat 7seal-expat2.1.0-15.el7_9+sp999
seal Red Hat 8expat2.2.5-16.el8_10+sp999, 2.2.5-4.0.1.el8_5.3+sp999
seal Red Hat 8seal-expat2.2.5-16.el8_10+sp999, 2.2.5-4.0.1.el8_5.3+sp999
ubuntu 14.04-ESMexpat2.1.0-4ubuntu1.4+esm4
ubuntu 16.04-ESMcoin33.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
ubuntu 16.04-ESMexpat2.1.0-7ubuntu0.16.04.5+esm2
ubuntu 16.04-ESMinsighttoolkit3.20.1+git20120521-6ubuntu0.1~esm1
ubuntu 16.04-ESMlibxmltok1.2-3ubuntu0.16.04.1~esm2
ubuntu 16.04-ESMswish-e2.4.7-4ubuntu0.1~esm1
ubuntu 18.04expat2.2.5-3ubuntu0.4
ubuntu 18.04-ESMcoin33.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
ubuntu 18.04-ESMexpat2.2.5-3ubuntu0.4
ubuntu 18.04-ESMlibxmltok1.2-4ubuntu0.18.04.1~esm1
ubuntu 18.04-ESMswish-e2.4.7-5ubuntu1+esm1
ubuntu 18.04-ESMxmlrpc-c1.33.14-8ubuntu0.18.04.1~esm1
ubuntu 20.04expat2.2.9-1ubuntu0.2
ubuntu 20.04-ESMexpat2.2.9-1ubuntu0.2
ubuntu 20.04-ESMlibxmltok1.2-4ubuntu0.20.04.1~esm1
ubuntu 20.04-ESMswish-e2.4.7-6ubuntu0.1~esm1
ubuntu 20.04-ESMxmlrpc-c1.33.14-8ubuntu0.20.04.1~esm1
ubuntu 21.10expat2.4.1-2ubuntu0.1
ubuntu 22.04expat2.4.5-2
ubuntu 22.04firefox1:1snap1-0ubuntu1
ubuntu 22.04libxmltoksin corrección indicada
ubuntu 22.04swish-esin corrección indicada
ubuntu 22.04xmlrpc-csin corrección indicada
ubuntu 22.10expat2.4.5-2
ubuntu 22.10firefox1:1snap1-0ubuntu1
ubuntu 23.04expat2.4.5-2
ubuntu 23.04firefox1:1snap1-0ubuntu1
ubuntu 23.10expat2.4.5-2
ubuntu 23.10firefox1:1snap1-0ubuntu1
ubuntu 24.04expat2.4.5-2
ubuntu 24.04firefox1:1snap1-0ubuntu1
ubuntu 24.04libxmltok1.2-4.1ubuntu1
ubuntu 24.04swish-esin corrección indicada
ubuntu 24.04xmlrpc-csin corrección indicada
ubuntu 24.10expat2.4.5-2
ubuntu 24.10firefox1:1snap1-0ubuntu1
ubuntu 24.10libxmltok1.2-4.1ubuntu1
ubuntu 25.04expat2.4.5-2
ubuntu 25.04firefox1:1snap1-0ubuntu1
ubuntu 25.04libxmltok1.2-4.1ubuntu1
ubuntu 25.10expat2.4.5-2
ubuntu 25.10firefox1:1snap1-0ubuntu1
ubuntu 26.04expat2.4.5-2
ubuntu 26.04firefox1:1snap1-0ubuntu1
ubuntu 26.04swish-esin corrección indicada
ubuntu 26.10expat2.4.5-2
ubuntu 26.10firefox1:1snap1-0ubuntu1
ubuntu 26.10swish-esin corrección indicada

Referencias

Las 42 referencias

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.