{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-40674", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-03T12:21:46.545Z", "dateReserved": "2022-09-14T00:00:00", "datePublished": "2022-09-14T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2022-11-22T00:00:00"}, "descriptions": [{"lang": "en", "value": "libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/libexpat/libexpat/pull/629"}, {"url": "https://github.com/libexpat/libexpat/pull/640"}, {"name": "DSA-5236", "tags": ["vendor-advisory"], "url": "https://www.debian.org/security/2022/dsa-5236"}, {"name": "[debian-lts-announce] 20220925 [SECURITY] [DLA 3119-1] expat security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00029.html"}, {"name": "GLSA-202209-24", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202209-24"}, {"name": "FEDORA-2022-15ec504440", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2ZKEPGFCZ7R6DRVH3K6RBJPT42ZBEG/"}, {"name": "FEDORA-2022-c68d90efc3", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J2IGJNHFV53PYST7VQV3T4NHVYAMXA36/"}, {"url": "https://security.netapp.com/advisory/ntap-20221028-0008/"}, {"name": "FEDORA-2022-d93b3bd8b9", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSVZN3IJ6OCPSJL7AEX3ZHSHAHFOGESK/"}, {"name": "FEDORA-2022-c22feb71ba", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE/"}, {"name": "FEDORA-2022-dcb1d7bcb1", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQB6FJAM5YQ35SF5B2MN25Y2FX56EOEZ/"}, {"name": "GLSA-202211-06", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202211-06"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:21:46.545Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/libexpat/libexpat/pull/629", "tags": ["x_transferred"]}, {"url": "https://github.com/libexpat/libexpat/pull/640", "tags": ["x_transferred"]}, {"name": "DSA-5236", "tags": ["vendor-advisory", "x_transferred"], "url": "https://www.debian.org/security/2022/dsa-5236"}, {"name": "[debian-lts-announce] 20220925 [SECURITY] [DLA 3119-1] expat security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00029.html"}, {"name": "GLSA-202209-24", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/202209-24"}, {"name": "FEDORA-2022-15ec504440", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2ZKEPGFCZ7R6DRVH3K6RBJPT42ZBEG/"}, {"name": "FEDORA-2022-c68d90efc3", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J2IGJNHFV53PYST7VQV3T4NHVYAMXA36/"}, {"url": "https://security.netapp.com/advisory/ntap-20221028-0008/", "tags": ["x_transferred"]}, {"name": "FEDORA-2022-d93b3bd8b9", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSVZN3IJ6OCPSJL7AEX3ZHSHAHFOGESK/"}, {"name": "FEDORA-2022-c22feb71ba", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE/"}, {"name": "FEDORA-2022-dcb1d7bcb1", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQB6FJAM5YQ35SF5B2MN25Y2FX56EOEZ/"}, {"name": "GLSA-202211-06", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/202211-06"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*", "matchCriteriaId": "FA91481F-5F79-4934-807C-6F480F2D4A3D", "versionEndExcluding": "2.4.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*", "matchCriteriaId": "80E516C0-98A4-4ADE-B69F-66A772E2BAAA", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*", "matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c."}, {"lang": "es", "value": "libexpat versiones anteriores a 2.4.9, presenta un uso de memoria previamente liberada en la funci\u00f3n doContent en el archivo xmlparse.c"}], "id": "CVE-2022-40674", "lastModified": "2024-11-21T07:21:49.660", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-09-14T11:15:54.020", "references": [{"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/libexpat/libexpat/pull/629"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/libexpat/libexpat/pull/640"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00029.html"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSVZN3IJ6OCPSJL7AEX3ZHSHAHFOGESK/"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J2IGJNHFV53PYST7VQV3T4NHVYAMXA36/"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQB6FJAM5YQ35SF5B2MN25Y2FX56EOEZ/"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2ZKEPGFCZ7R6DRVH3K6RBJPT42ZBEG/"}, {"source": "cve@mitre.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202209-24"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202211-06"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20221028-0008/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2022/dsa-5236"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/libexpat/libexpat/pull/629"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/libexpat/libexpat/pull/640"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00029.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSVZN3IJ6OCPSJL7AEX3ZHSHAHFOGESK/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J2IGJNHFV53PYST7VQV3T4NHVYAMXA36/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQB6FJAM5YQ35SF5B2MN25Y2FX56EOEZ/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2ZKEPGFCZ7R6DRVH3K6RBJPT42ZBEG/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202209-24"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202211-06"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20221028-0008/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2022/dsa-5236"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2022:6921", "cpe": "cpe:/o:redhat:rhel_els:6", "package": "expat-0:2.0.1-15.el6_10", "product_name": "Red Hat Enterprise Linux 6 Extended Lifecycle Support", "release_date": "2022-10-12T00:00:00Z"}, {"advisory": "RHSA-2022:6967", "cpe": "cpe:/o:redhat:rhel_els:6", "package": "compat-expat1-0:1.95.8-9.el6_10", "product_name": "Red Hat Enterprise Linux 6 Extended Lifecycle Support", "release_date": "2022-10-17T00:00:00Z"}, {"advisory": "RHSA-2022:6834", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "expat-0:2.1.0-15.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-10-06T00:00:00Z"}, {"advisory": "RHSA-2022:6997", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:102.3.0-7.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-10-18T00:00:00Z"}, {"advisory": "RHSA-2022:6998", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:102.3.0-4.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-10-18T00:00:00Z"}, {"advisory": "RHSA-2022:7023", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:102.3.0-4.el8_6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-10-18T00:00:00Z"}, {"advisory": "RHSA-2022:7024", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:102.3.0-7.el8_6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-10-18T00:00:00Z"}, {"advisory": "RHSA-2023:3068", "cpe": "cpe:/a:redhat:enterprise_linux:8::crb", "package": "mingw-expat-0:2.4.8-2.el8", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-05-16T00:00:00Z"}, {"advisory": "RHSA-2022:6878", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "expat-0:2.2.5-8.el8_6.3", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-10-11T00:00:00Z"}, {"advisory": "RHSA-2022:7019", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "firefox-0:102.3.0-7.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-10-18T00:00:00Z"}, {"advisory": "RHSA-2022:7021", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "thunderbird-0:102.3.0-4.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-10-18T00:00:00Z"}, {"advisory": "RHSA-2022:6833", "cpe": "cpe:/o:redhat:rhel_e4s:8.1", "package": "expat-0:2.2.5-3.el8_1.2", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-10-06T00:00:00Z"}, {"advisory": "RHSA-2022:6996", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "thunderbird-0:102.3.0-4.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-10-18T00:00:00Z"}, {"advisory": "RHSA-2022:7022", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "firefox-0:102.3.0-7.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-10-18T00:00:00Z"}, {"advisory": "RHSA-2022:6832", "cpe": "cpe:/o:redhat:rhel_eus:8.2", "package": "expat-0:2.2.5-3.el8_2.3", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-10-06T00:00:00Z"}, {"advisory": "RHSA-2022:6995", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "thunderbird-0:102.3.0-4.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-10-18T00:00:00Z"}, {"advisory": "RHSA-2022:7025", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "firefox-0:102.3.0-7.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-10-18T00:00:00Z"}, {"advisory": "RHSA-2022:6831", "cpe": "cpe:/o:redhat:rhel_eus:8.4", "package": "expat-0:2.2.5-4.el8_4.4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-10-06T00:00:00Z"}, {"advisory": "RHSA-2022:6838", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "expat-0:2.2.10-12.el9_0.3", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-10-06T00:00:00Z"}, {"advisory": "RHSA-2022:7020", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "firefox-0:102.3.0-7.el9_0", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-10-18T00:00:00Z"}, {"advisory": "RHSA-2022:7026", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "thunderbird-0:102.3.0-4.el9_0", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-10-18T00:00:00Z"}, {"advisory": "RHSA-2022:6838", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "expat-0:2.2.10-12.el9_0.3", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-10-06T00:00:00Z"}, {"advisory": "RHSA-2022:8841", "cpe": "cpe:/a:redhat:jboss_core_services:1", "package": "expat", "product_name": "Red Hat JBoss Core Services 1", "release_date": "2022-12-08T00:00:00Z"}, {"advisory": "RHSA-2022:8598", "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8", "package": "redhat-virtualization-host-0:4.5.3-202211170828_8.6", "product_name": "Red Hat Virtualization 4 for Red Hat Enterprise Linux 8", "release_date": "2022-11-22T00:00:00Z"}], "bugzilla": {"description": "expat: a use-after-free in the doContent function in xmlparse.c", "id": "2130769", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2130769"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-416", "details": ["libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.", "A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal entity so that XML_ResumeParser directly uses the internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags, this will return without calling storeRawNames to ensure that the raw versions of the tag names are stored in memory other than the parse buffer itself. Issues occur if the parse buffer is changed or reallocated (for example, if processing a file line by line), problems occur. Using this vulnerability in the doContent function allows an attacker to triage a denial of service or potentially arbitrary code execution."], "mitigation": {"lang": "en:us", "value": "There is no known mitigation other than restricting applications using the expat library from processing XML content. Please update the affected packages as soon as possible."}, "name": "CVE-2022-40674", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "firefox:flatpak/firefox", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "thunderbird:flatpak/thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "xmlrpc-c", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "firefox:flatpak/firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "thunderbird:flatpak/thunderbird", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2022-09-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-40674\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-40674\nhttps://blog.hartwork.org/posts/expat-2-4-9-released/\nhttps://github.com/advisories/GHSA-2vq2-xc55-3j5m"], "statement": "This flaw is rated as important because this flaw can easily compromise the confidentiality, integrity, or availability of resources but a successful attack can not execute arbitrary code, or allow remote users to cause a denial of service because attack complexity is high and depends on conditions beyond the attacker's control.", "threat_severity": "Important", "upstream_fix": "expat 2.4.9"}