ID

VAR-202202-0114

CVE

CVE-2022-25236

TITLE

Debian Security Advisory 5085-1

DESCRIPTION

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. There is a security vulnerability before Expat2.4.5, which can be exploited by an attacker to insert a namespace separator into a namespace URI. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5085-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso February 22, 2022 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : expat CVE ID : CVE-2022-25235 CVE-2022-25236 CVE-2022-25313 CVE-2022-25314 CVE-2022-25315 Debian Bug : 1005894 1005895 Several vulnerabilities have been discovered in Expat, an XML parsing C library, which could result in denial of service or potentially the execution of arbitrary code, if a malformed XML file is processed. For the oldstable distribution (buster), these problems have been fixed in version 2.2.6-2+deb10u3. For the stable distribution (bullseye), these problems have been fixed in version 2.2.10-2+deb11u2. We recommend that you upgrade your expat packages. For the detailed security status of expat please refer to its security tracker page at: https://security-tracker.debian.org/tracker/expat Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmIVRKdfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0SL9w//RNie279tKBMcCgzAMRvLLaRJuNSs/akfBMFJ77Db4X/CSprrIseKoK8N Z0jA6pMK+AvY4NW+lhOKq3C1j5ZrtuudHdq17QJoJqBYcvl6vZjbwomr+aVhMg5E D3BwTC4jS9FDeo5eaxsq816gFaR6fEnRXCVeTIp7eu32dOzdf+9cqFBWJM5B3ivK F50Y+NH+tTq3tyjD983XxdFpO8w2hHkIlWQGJk550Qxuyww6gEyrr2fu7ixYNcB9 /+UDebxV4IDg5UnzEvcvR2acIX6oL3+HeKoRBj8D6IiA4hS+A2XReOnRZz5AulM8 pBHz+oJfoh+a/l7YBZ83Q7pmlXXvKcQQ0Z8gEURJhpbQkUdgfQROduzQVvbQdBxX Olq62vZXTi0W6FaKiCrY+PP//aCpflcl9zP1odU0grg/oWiVN6bZMUG/Fj+eZdRv TCJZTLvRGpMhvmISadKBtXcXcxXJYvijva7zqsDp+oRemiLwOytqNzyfmTUm1rff JvWLnyviQDtLcDq41+a+vI7wbwSZ/K8v5cUp8mWqw7TT28u0wcILKC+jLCo7GsrV tL71cV6hI7aw/VNziwSJsfs5Ei7jDchNQKoEJh/Z108EZnjeNBZr2PNhRoyvVaau mxgqrfbcayyjrw+EE12OaA7zpBv/DS7HR7mKU3O8DdFNI4J2w/E= =MVQQ -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Virtualization Host security and enhancement update [ovirt-4.4.10] Async #2 Advisory ID: RHSA-2022:1053-01 Product: Red Hat Virtualization Advisory URL: https://access.redhat.com/errata/RHSA-2022:1053 Issue date: 2022-03-24 CVE Names: CVE-2022-25235 CVE-2022-25236 CVE-2022-25315 ==================================================================== 1. Summary: An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: RHEL 8-based RHEV-H for RHEV 4 (build requirements) - noarch, x86_64 Red Hat Virtualization 4 Hypervisor for RHEL 8 - x86_64 3. Description: The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. Security Fix(es): * expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235) * expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236) * expat: Integer overflow in storeRawNames() (CVE-2022-25315) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Red Hat Virtualization Host was rebased on Red Hat Enterprise Linux 8.5.0.3. (BZ#2048407) * Rebase package(s) to version: libvirt-7.6.0-6.1.module+el8.5.0+14474+b3410d40 Highlights and important bug fixes: consume libvirt fix for failure to connect socket to '/run/libvirt/virtlogd-sock' - possibly caused by too many open files from libvirtd. (BZ#2057048) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891 5. Bugs fixed (https://bugzilla.redhat.com/): 2034626 - Upgrade elfutils to elfutils-0.185-1.el8 2048407 - Rebase RHV-H 4.4.10 on RHEL 8.5.0.3 2056363 - CVE-2022-25315 expat: Integer overflow in storeRawNames() 2056366 - CVE-2022-25235 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution 2056370 - CVE-2022-25236 expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution 2057048 - consume libvirt fix for: Failed to connect socket to '/run/libvirt/virtlogd-sock' - possibly caused by Too many open files from libvirtd 6. Package List: Red Hat Virtualization 4 Hypervisor for RHEL 8: Source: elfutils-0.185-1.el8.src.rpm redhat-virtualization-host-4.4.10-202203211649_8.5.src.rpm x86_64: elfutils-debuginfo-0.185-1.el8.x86_64.rpm elfutils-debuginfod-client-0.185-1.el8.x86_64.rpm elfutils-debuginfod-client-debuginfo-0.185-1.el8.x86_64.rpm elfutils-debuginfod-debuginfo-0.185-1.el8.x86_64.rpm elfutils-debugsource-0.185-1.el8.x86_64.rpm elfutils-devel-0.185-1.el8.x86_64.rpm elfutils-libelf-debuginfo-0.185-1.el8.x86_64.rpm elfutils-libs-debuginfo-0.185-1.el8.x86_64.rpm redhat-virtualization-host-image-update-4.4.10-202203211649_8.5.x86_64.rpm RHEL 8-based RHEV-H for RHEV 4 (build requirements): Source: redhat-release-virtualization-host-4.4.10-3.el8ev.src.rpm noarch: redhat-virtualization-host-image-update-placeholder-4.4.10-3.el8ev.noarch.rpm x86_64: redhat-release-virtualization-host-4.4.10-3.el8ev.x86_64.rpm redhat-release-virtualization-host-content-4.4.10-3.el8ev.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-25235 https://access.redhat.com/security/cve/CVE-2022-25236 https://access.redhat.com/security/cve/CVE-2022-25315 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYjyObtzjgjWX9erEAQgVfRAAkn+C8psWL5puBda6ty9qD6KjY6BMGqH+ us3YStx9Dk/frDv1eRHtQd0pNNPfNNvah3Y/OraXEbX8DfiMczGL/3ESHXnlNl8b l0BE08QeJig4Q2WIOwcGyyB4jIepDt+bilDKSck+f84UN+mgk/Iqn8XvKE8WnRwk TebToONC7hwnSjdHt1XlF6pEqpAo5XOpwCfzpGNmVWvt3Ddgas2EE6eUkFNaKOBN UFe1ZTyvSgZpmr4Kxx7AoF3+CnnEJb8lCrRG71cVsPLHBAiwcEMOQN8yfCqj30il DhCWhchX7OcVwJBhOLUR87SheaUxhfLJAaieyW4gisbot5KbWZgM0GTt0Lr2/z7G CLuFzXwFZGjsljH7iXRjdDt/8D7CThMTF+6jkkW+jJuVYFyCh12OTAmSd9LJ8xB4 jfvj3ow7Gmrzn9QN67DcqTQ+DHWEvUScy8qfs0lAz1XatPi2tf2dNO/IxSdz/bV3 /mBkMOYbYPgSeT/6i7m2pp+3iXq6QZfAFIvVaqolVWZOuBbX8cU+XOUcrQvT+L5Y NNlrSJvxZ4VVaaHbqudizFYvkni12V8tQe7uPsNpTJi3iTc8ShtoTtGTiUPE7mff fhB9jEGy0yuIEg0VlokjRCEo5Q3D5xfPPQZeTOEiAciksQJn6PhjR9MuaxtXEYqq +Ej7k5UtzjI=TqDc -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Bug Fix(es): * RHV-H has been rebased on RHEL-7.9.z #13 (BZ#2048409) 4. Description: Mozilla Thunderbird is a standalone mail and newsgroup client. Description: Expat is a C library for parsing XML documents. 8) - aarch64, ppc64le, s390x, x86_64 3. 8.1) - ppc64le, x86_64 3. Description: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 91.7.0 ESR

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

TYPE

overflow, code execution

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2025-03-31T15:51:16.983000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE