NetSight
IP …
critical9.8

CVE-2022-25235

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain con…

Impact

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

Affected products

VendorProductAffected versions
Libexpat ProjectLibexpat
before 2.4.5
DebianDebian Linux
Versions 10.0, 11.0
FedoraprojectFedora
Versions 34, 35
OracleHttp Server
Versions 12.2.1.3.0, 12.2.1.4.0
OracleZfs Storage Appliance Kit
Version 8.8
SiemensSinema Remote Connect Server
before 3.1

Weakness classification

CWE-116

References