CVE-2022-40674

Public on 2022-09-14
Modified on 2024-02-07
Description
A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal entity so that XML_ResumeParser directly uses the internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags, this will return without calling storeRawNames to ensure that the raw versions of the tag names are stored in memory other than the parse buffer itself. Issues occur if the parse buffer is changed or reallocated (for example, if processing a file line by line), problems occur. Using this vulnerability in the doContent function allows an attacker to triage a denial of service or potentially arbitrary code execution.
Severity
Important severity
Important
CVSS v3 Base Score
9.8
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 expat 2022-12-01 ALAS-2022-1654 Fixed
Amazon Linux 2 - Core expat 2022-10-31 ALAS2-2022-1877 Fixed
Amazon Linux 2023 expat 2023-02-17 ALAS2023-2023-058 Fixed
Amazon Linux 2 - Firefox Extra firefox 2023-08-21 ALAS2FIREFOX-2023-010 Fixed
Amazon Linux 2 - Core thunderbird 2022-12-01 ALAS2-2022-1900 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVSSv3 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H