CVE-2022-23852

概要

参考情報

• cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf · Third Party Advisory
• libexpat/libexpat#550 · Issue Tracking
• lists.debian.org/debian-lts-announce/2022/03/msg00007.html · Mailing List
• security.gentoo.org/glsa/202209-24 · Third Party Advisory
• security.netapp.com/advisory/ntap-20220217-0001 · Third Party Advisory
• debian.org/security/2022/dsa-5073 · Third Party Advisory
• oracle.com/security-alerts/cpuapr2022.html · Third Party Advisory
• tenable.com/security/tns-2022-05 · Third Party Advisory
• cert-portal.siemens.com/productcert/html/ssa-398330.html
• cert-portal.siemens.com/productcert/html/ssa-484086.html

libexpat のその他の脆弱性

• CVE-2026-76957高 7.8libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is simi…
• CVE-2026-76956高 7.5In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in bein…
• CVE-2026-66046高 7.5Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xml…
• CVE-2026-56412中 5.9libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls fr…
• CVE-2026-56411中 6.9xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.