CVE-2022-25235
Description
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
Risk Information
Base Score
9.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
13.322
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Multiple vulnerabilities are fixed in IBM HTTP 8.5.5.2 | Windows |
| Multiple vulnerabilities are fixed in IBM HTTP 9.0.5.12 | Windows |
| Multiple vulnerabilities are fixed in Nessus 8.15.5 | Windows |
| Multiple vulnerabilities are fixed in Nessus Agent (x64) (10.2.0.20130) | Windows |
| Multiple vulnerabilities are fixed in Nessus Agent (10.2.0.20130) | Windows |
| Multiple vulnerabilities are fixed in Tenable Nessus 8.15.5 | Windows |
| Multiple vulnerabilities are fixed in Tenable Nessus 10.2.0 | Windows |
| Multiple Vulnerabilities are affected in IBM Tivoli Monitoring 6.3.0.7 | Windows |
| XML parsing C library (USN-5288-1) libexpat1_2.2.5-3ubuntu0.7_i386.deb | Linux |
| XML parsing C library (USN-5288-1) libexpat1_2.2.5-3ubuntu0.7_amd64.deb | Linux |
| XML parsing C library (USN-5288-1) libexpat1_2.2.9-1ubuntu0.4_i386.deb | Linux |
| XML parsing C library (USN-5288-1) libexpat1_2.2.9-1ubuntu0.4_amd64.deb | Linux |
| XML parsing C library (USN-5288-1) libexpat1_2.4.1-2ubuntu0.3_i386.deb | Linux |
| XML parsing C library (USN-5288-1) libexpat1_2.4.1-2ubuntu0.3_amd64.deb | Linux |
| expat security update(DSA-5085-1) expat_2.2.6-2+deb10u3_i386.deb | Linux |
| expat security update(DSA-5085-1) expat_2.2.6-2+deb10u3_amd64.deb | Linux |
| expat security update(DSA-5085-1) expat_2.2.10-2+deb11u2_amd64.deb | Linux |
| (RHSA-2022:0818) firefox security update firefox-91.7.0-3.el8_5.x86_64.rpm | Linux |
| (RHSA-2022:0818) firefox security update firefox-debugsource-91.7.0-3.el8_5.x86_64.rpm | Linux |
| (RHSA-2022:0824) firefox security and bug fix update firefox-91.7.0-3.el7_9.i686.rpm | Linux |
| (RHSA-2022:0824) firefox security and bug fix update firefox-91.7.0-3.el7_9.x86_64.rpm | Linux |
| (RHSA-2022:0845) thunderbird security update thunderbird-91.7.0-2.el8_5.x86_64.rpm | Linux |
| (RHSA-2022:0845) thunderbird security update thunderbird-debugsource-91.7.0-2.el8_5.x86_64.rpm | Linux |
| (RHSA-2022:0850) thunderbird security update thunderbird-91.7.0-2.el7_9.x86_64.rpm | Linux |
| Firefox update (ELSA-2022-0824) firefox-91.7.0-3.0.1.el7_9.i686.rpm | Linux |
| Firefox update (ELSA-2022-0824) firefox-91.7.0-3.0.1.el7_9.x86_64.rpm | Linux |
| Thunderbird update (ELSA-2022-0850) thunderbird-91.7.0-2.0.1.el7_9.x86_64.rpm | Linux |
| (RHSA-2022:0951) expat security update expat-debugsource-2.2.5-4.el8_5.3.i686.rpm | Linux |
| (RHSA-2022:0951) expat security update expat-debugsource-2.2.5-4.el8_5.3.x86_64.rpm | Linux |
| (RHSA-2022:1069) expat security update expat-2.1.0-14.el7_9.i686.rpm | Linux |
| (RHSA-2022:1069) expat security update expat-2.1.0-14.el7_9.x86_64.rpm | Linux |
| (RHSA-2022:1069) expat security update expat-devel-2.1.0-14.el7_9.i686.rpm | Linux |
| (RHSA-2022:1069) expat security update expat-devel-2.1.0-14.el7_9.x86_64.rpm | Linux |
| (RHSA-2022:1069) expat security update expat-static-2.1.0-14.el7_9.i686.rpm | Linux |
| (RHSA-2022:1069) expat security update expat-static-2.1.0-14.el7_9.x86_64.rpm | Linux |
| Thunderbird update (ELSA-2022-0845) thunderbird-91.7.0-2.0.1.el8_5.x86_64.rpm | Linux |
| Expat update (ELSA-2022-0951) expat-2.2.5-4.el8_5.3.i686.rpm | Linux |
| Expat update (ELSA-2022-0951) expat-2.2.5-4.el8_5.3.x86_64.rpm | Linux |
| Expat-devel update (ELSA-2022-0951) expat-devel-2.2.5-4.el8_5.3.i686.rpm | Linux |
| Expat-devel update (ELSA-2022-0951) expat-devel-2.2.5-4.el8_5.3.x86_64.rpm | Linux |
| SUSE-SU-2022:0698-1(SUSE Linux Enterprise Server 12-SP5 ) expat-2.1.0-21.18.1.x86_64.rpm | Linux |
| SUSE-SU-2022:0698-1(SUSE Linux Enterprise Server 12-SP5 ) expat-debuginfo-2.1.0-21.18.1.x86_64.rpm | Linux |
| SUSE-SU-2022:0698-1(SUSE Linux Enterprise Server 12-SP5 ) expat-debuginfo-32bit-2.1.0-21.18.1.x86_64.rpm | Linux |
| SUSE-SU-2022:0698-1(SUSE Linux Enterprise Server 12-SP5 ) expat-debugsource-2.1.0-21.18.1.x86_64.rpm | Linux |
| SUSE-SU-2022:0698-1(SUSE Linux Enterprise Server 12-SP5 ) libexpat1-2.1.0-21.18.1.x86_64.rpm | Linux |
| SUSE-SU-2022:0698-1(SUSE Linux Enterprise Server 12-SP5 ) libexpat1-32bit-2.1.0-21.18.1.x86_64.rpm | Linux |
| SUSE-SU-2022:0698-1(SUSE Linux Enterprise Server 12-SP5 ) libexpat1-debuginfo-2.1.0-21.18.1.x86_64.rpm | Linux |
| SUSE-SU-2022:0698-1(SUSE Linux Enterprise Server 12-SP5 ) libexpat1-debuginfo-32bit-2.1.0-21.18.1.x86_64.rpm | Linux |
| Expat update (ELSA-2022-1069) expat-2.1.0-14.0.1.el7_9.i686.rpm | Linux |
| Expat update (ELSA-2022-1069) expat-2.1.0-14.0.1.el7_9.x86_64.rpm | Linux |
| Expat-devel update (ELSA-2022-1069) expat-devel-2.1.0-14.0.1.el7_9.i686.rpm | Linux |
| Expat-devel update (ELSA-2022-1069) expat-devel-2.1.0-14.0.1.el7_9.x86_64.rpm | Linux |
| Expat-static update (ELSA-2022-1069) expat-static-2.1.0-14.0.1.el7_9.i686.rpm | Linux |
| Expat-static update (ELSA-2022-1069) expat-static-2.1.0-14.0.1.el7_9.x86_64.rpm | Linux |
| Xmlrpc-c update (ELSA-2022-1643) xmlrpc-c-1.51.0-5.el8_5.1.i686.rpm | Linux |
| Xmlrpc-c update (ELSA-2022-1643) xmlrpc-c-1.51.0-5.el8_5.1.x86_64.rpm | Linux |
| Xmlrpc-c-c++ update (ELSA-2022-1643) xmlrpc-c-c++-1.51.0-5.el8_5.1.i686.rpm | Linux |
| Xmlrpc-c-c++ update (ELSA-2022-1643) xmlrpc-c-c++-1.51.0-5.el8_5.1.x86_64.rpm | Linux |
| Xmlrpc-c-client update (ELSA-2022-1643) xmlrpc-c-client-1.51.0-5.el8_5.1.i686.rpm | Linux |
| Xmlrpc-c-client update (ELSA-2022-1643) xmlrpc-c-client-1.51.0-5.el8_5.1.x86_64.rpm | Linux |
| Xmlrpc-c-client++ update (ELSA-2022-1643) xmlrpc-c-client++-1.51.0-5.el8_5.1.i686.rpm | Linux |
| Xmlrpc-c-client++ update (ELSA-2022-1643) xmlrpc-c-client++-1.51.0-5.el8_5.1.x86_64.rpm | Linux |
| Xmlrpc-c-devel update (ELSA-2022-1643) xmlrpc-c-devel-1.51.0-5.el8_5.1.i686.rpm | Linux |
| Xmlrpc-c-devel update (ELSA-2022-1643) xmlrpc-c-devel-1.51.0-5.el8_5.1.x86_64.rpm | Linux |
| (RHSA-2022:1643) xmlrpc-c security update xmlrpc-c-debugsource-1.51.0-5.el8_5.1.i686.rpm | Linux |
| (RHSA-2022:1643) xmlrpc-c security update xmlrpc-c-debugsource-1.51.0-5.el8_5.1.x86_64.rpm | Linux |
| SUSE-SU-2023:4614-1(SUSE Linux Enterprise Server 12 SP5 ) java-1_8_0-ibm-1.8.0_sr8.15-30.117.1.x86_64.rpm | Linux |
| SUSE-SU-2023:4614-1(SUSE Linux Enterprise Server 12 SP5 ) java-1_8_0-ibm-alsa-1.8.0_sr8.15-30.117.1.x86_64.rpm | Linux |
| SUSE-SU-2023:4614-1(SUSE Linux Enterprise Server 12 SP5 ) java-1_8_0-ibm-devel-1.8.0_sr8.15-30.117.1.x86_64.rpm | Linux |
| SUSE-SU-2023:4614-1(SUSE Linux Enterprise Server 12 SP5 ) java-1_8_0-ibm-plugin-1.8.0_sr8.15-30.117.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) wayland-devel-1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) libwayland-egl1-99~1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) libwayland-client0-1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) libwayland-cursor0-1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) libwayland-server0-1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) wayland-debugsource-1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) wayland-devel-debuginfo-1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) libwayland-client0-32bit-1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) libwayland-server0-32bit-1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) libwayland-egl1-debuginfo-99~1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) libwayland-client0-debuginfo-1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) libwayland-cursor0-debuginfo-1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) libwayland-server0-debuginfo-1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) libwayland-client0-32bit-debuginfo-1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| SUSE-SU-2023:1860-1(Basesystem Module 15-SP4 ) libwayland-server0-32bit-debuginfo-1.19.0-150400.3.3.1.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2022-1795) xmlrpc-c-1.32.5-1905.svn2451.amzn2.0.2.i686.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2022-1795) xmlrpc-c-1.32.5-1905.svn2451.amzn2.0.2.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2022-1795) xmlrpc-c-c++-1.32.5-1905.svn2451.amzn2.0.2.i686.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2022-1795) xmlrpc-c-c++-1.32.5-1905.svn2451.amzn2.0.2.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2022-1795) xmlrpc-c-apps-1.32.5-1905.svn2451.amzn2.0.2.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2022-1795) xmlrpc-c-devel-1.32.5-1905.svn2451.amzn2.0.2.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2022-1795) xmlrpc-c-client-1.32.5-1905.svn2451.amzn2.0.2.i686.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2022-1795) xmlrpc-c-client-1.32.5-1905.svn2451.amzn2.0.2.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2022-1795) xmlrpc-c-client++-1.32.5-1905.svn2451.amzn2.0.2.i686.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2022-1795) xmlrpc-c-client++-1.32.5-1905.svn2451.amzn2.0.2.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2023-068) xmlrpc-c-1.51.08-2.amzn2023.0.1.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2023-068) xmlrpc-c-c++-1.51.08-2.amzn2023.0.1.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2023-068) xmlrpc-c-apps-1.51.08-2.amzn2023.0.1.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2023-068) xmlrpc-c-devel-1.51.08-2.amzn2023.0.1.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2023-068) xmlrpc-c-client-1.51.08-2.amzn2023.0.1.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS-2023-068) xmlrpc-c-client++-1.51.08-2.amzn2023.0.1.x86_64.rpm | Linux |
| expat Security Update (ALAS2023-2023-058) expat-2.5.0-1.amzn2023.0.2.x86_64.rpm | Linux |
| expat Security Update (ALAS2023-2023-058) expat-devel-2.5.0-1.amzn2023.0.2.x86_64.rpm | Linux |
| expat Security Update (ALAS2023-2023-058) expat-static-2.5.0-1.amzn2023.0.2.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS2023-2023-068) xmlrpc-c-1.51.08-2.amzn2023.0.1.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS2023-2023-068) xmlrpc-c-apps-1.51.08-2.amzn2023.0.1.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS2023-2023-068) xmlrpc-c-c++-1.51.08-2.amzn2023.0.1.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS2023-2023-068) xmlrpc-c-client-1.51.08-2.amzn2023.0.1.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS2023-2023-068) xmlrpc-c-client++-1.51.08-2.amzn2023.0.1.x86_64.rpm | Linux |
| xmlrpc-c Security Update (ALAS2023-2023-068) xmlrpc-c-devel-1.51.08-2.amzn2023.0.1.x86_64.rpm | Linux |
| Improper Encoding or Escaping of Output Vulnerability (CVE-2022-25235) | NCM |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-346982 | Nessus Agent (x64) (10.8.4) (Manual Upload Required) |
| PATCH-346981 | Nessus Agent (10.8.4) (Manual Upload Required) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234