Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
DSA-5085-1
No affected components available
expat - security update
Measures severity based on intrinsic characteristics of the vulnerability, independent of environment.
No exploitation activity has been observed at this time. Continue routine monitoring.
The exploit probability is moderate. The vulnerability is likely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
- CVE-2022-25235
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
UpstreamEPSS 5.0% - CVE-2022-25236
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
UpstreamEPSS 35.9% - CVE-2022-25313
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
UpstreamEPSS 3.3% - CVE-2022-25314
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
UpstreamEPSS 4.7% - CVE-2022-25315
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
UpstreamEPSS 4.8% - EUVD-2022-29933Upstream
- EUVD-2022-29934Upstream
- EUVD-2022-29996Upstream
- EUVD-2022-29997Upstream
- EUVD-2022-29998Upstream
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard