=====================================================================

                             CERT-Renater

                   Note d'Information No. 2021/VULN087
_____________________________________________________________________

DATE                : 22/02/2022

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Expat versions prior to 2.4.6.

=====================================================================
https://github.com/libexpat/libexpat/blob/R_2_4_6/expat/Changes
_____________________________________________________________________

NOTE: We are looking for help with a few things:
       https://github.com/libexpat/libexpat/labels/help%20wanted
       If you can help, please get in touch.  Thanks!

Release 2.4.6 Sun February 20 2022
    Bug fixes:
       #566  Fix a regression introduced by the fix for CVE-2022-25313
             in release 2.4.5 that affects applications that (1)
             call function XML_SetElementDeclHandler and (2) are
             parsing XML that contains nested element declarations
             (e.g. "<!ELEMENT junk ((bar|foo|xyz+), zebra*)>").

       Other changes:
       #567 #568  Version info bumped from 9:5:8 to 9:6:8;
                     see https://verbump.de/ for what these numbers do

         Special thanks to:
             Matt Sergeant
             Samanta Navarro
             Sergei Trofimovich
                  and
             NixOS
             Perl XML::Parser

Release 2.4.5 Fri February 18 2022
    Security fixes:
       #562  CVE-2022-25235 -- Passing malformed 2- and 3-byte UTF-8
            sequences (e.g. from start tag names) to the XML
            processing application on top of Expat can cause
            arbitrary damage (e.g. code execution) depending
            on how invalid UTF-8 is handled inside the XML
                     processor; validation was not their job but Expat's.
                     Exploits with code execution are known to exist.
        #561  CVE-2022-25236 -- Passing (one or more) namespace separator
             characters in "xmlns[:prefix]" attribute values
             made Expat send malformed tag names to the XML
             processor on top of Expat which can cause
             arbitrary damage (e.g. code execution) depending
             on such unexpectable cases are handled inside the XML
             processor; validation was not their job but Expat's.
              Exploits with code execution are known to exist.
        #558  CVE-2022-25313 -- Fix stack exhaustion in doctype parsing
              that could be triggered by e.g. a 2 megabytes
              file with a large number of opening braces.
              Expected impact is denial of service or potentially
              arbitrary code execution.
        #560  CVE-2022-25314 -- Fix integer overflow in function copyString;
              only affects the encoding name parameter at parser creation
              time which is often hardcoded (rather than user input),
              takes a value in the gigabytes to trigger, and a 64-bit
              machine.  Expected impact is denial of service.
        #559  CVE-2022-25315 -- Fix integer overflow in function 
storeRawNames;
               needs input in the gigabytes and a 64-bit machine.
               Expected impact is denial of service or potentially
               arbitrary code execution.

         Other changes:
        #557 #564  Version info bumped from 9:4:8 to 9:5:8;
                     see https://verbump.de/ for what these numbers do

         Special thanks to:
             Ivan Fratric
             Samanta Navarro
                  and
             Google Project Zero
             JetBrains


=========================================================
+ CERT-RENATER       | tel : 01-53-94-20-44             +
+ 23/25 Rue Daviel   | fax : 01-53-94-20-41             +
+ 75013 Paris        | email:cert@support.renater.fr    +
=========================================================