debian/libxmltok vulnerabilities

Latest debian/libxmltok CVEs

Newest publication first · page 1 of 2

1. CVE-2024-8176 Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

   Published 2025-03-14

   High·CVSS 7.5 EPSS 1.4%

   A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and c...

2. CVE-2024-50602 An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

   Published 2024-10-27

   Medium·CVSS 5.9 EPSS 1.1%

   An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

3. CVE-2024-45492 An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

   Published 2024-08-30

   Critical·CVSS 9.8 EPSS 1.4%

   An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

4. CVE-2024-45491 An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

   Published 2024-08-30

   Critical·CVSS 9.8 EPSS 1.1%

   An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

5. CVE-2024-45490 An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

   Published 2024-08-30

   High·CVSS 7.5 EPSS 1.7%

   An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

6. CVE-2024-28757 libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

   Published 2024-03-10

   High·CVSS 7.5 EPSS 2.0%

   libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

7. CVE-2023-52426 libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

   Published 2024-02-04

   Medium·CVSS 5.5 EPSS 0.39%

   libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

8. CVE-2023-52425 libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

   Published 2024-02-04

   High·CVSS 7.5 EPSS 2.1%

   libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

9. CVE-2022-43680 In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

   Published 2022-10-24

   High·CVSS 7.5 EPSS 3.2%

   In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

10. CVE-2022-40674 libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

    Published 2022-09-14

    High·CVSS 8.1 EPSS 2.4%

    libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

11. CVE-2022-25314 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

    Published 2022-02-18

    High·CVSS 7.5 EPSS 4.8%

    In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

12. CVE-2022-25315 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

    Published 2022-02-18

    Critical·CVSS 9.8 EPSS 4.8%

    In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

13. CVE-2022-25313 In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

    Published 2022-02-18

    Medium·CVSS 6.5 EPSS 3.3%

    In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

14. CVE-2022-25235 xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

    Published 2022-02-16

    Critical·CVSS 9.8 EPSS 5.0%

    xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

15. CVE-2022-25236 xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

    Published 2022-02-16

    Critical·CVSS 9.8 EPSS 35.3%

    xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

16. CVE-2022-23990 Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

    Published 2022-01-26

    High·CVSS 7.5 EPSS 4.7%

    Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

17. CVE-2022-23852 Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

    Published 2022-01-24

    Critical·CVSS 9.8 EPSS 5.1%

    Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

18. CVE-2022-22822 addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    Published 2022-01-08

    Critical·CVSS 9.8 EPSS 5.5%

    addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

19. CVE-2022-22823 build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    Published 2022-01-08

    Critical·CVSS 9.8 EPSS 3.9%

    build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

20. CVE-2022-22824 defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    Published 2022-01-08

    Critical·CVSS 9.8 EPSS 3.9%

    defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

21. CVE-2022-22825 lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    Published 2022-01-08

    High·CVSS 8.8 EPSS 3.0%

    lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

22. CVE-2022-22826 nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    Published 2022-01-08

    High·CVSS 8.8 EPSS 3.2%

    nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

23. CVE-2022-22827 storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

    Published 2022-01-08

    High·CVSS 8.8 EPSS 3.2%

    storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

24. CVE-2021-46143 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

    Published 2022-01-06

    High·CVSS 7.8 EPSS 4.5%

    In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

25. CVE-2021-45960 In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memor...

    Published 2022-01-01

    High·CVSS 8.8 EPSS 4.7%

    In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.