CVE-2022-25313

Published: Feb 18, 2022Modified: Oct 14, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

Affected (9)

Products: Libexpat Project: Libexpat · Debian: Debian Linux · Fedoraproject: Fedora · +2 more

Show all products

Libexpat Project: Libexpat · Debian: Debian Linux · Fedoraproject: Fedora · Oracle: Http Server, Zfs Storage Appliance Kit · Siemens: Sinema Remote Connect Server

1 product

1 product

1 product

2 products

Zfs Storage Appliance Kit

Siemens

1 product

Sinema Remote Connect Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libexpat Project Libexpat	version < 2.4.5

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Http Server	Version 12.2.1.3.0
Oracle Http Server	Version 12.2.1.4.0
Oracle Zfs Storage Appliance Kit	Version 8.8

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Siemens Sinema Remote Connect Server	version < 3.1

Related CWEs

CWE-674

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (22)

http://www.openwall.com/lists/oss-security/2022/02/19/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf

Source: cve@mitre.org

Third Party Advisory

https://github.com/libexpat/libexpat/pull/558

Source: cve@mitre.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html

Source: cve@mitre.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202209-24

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220303-0008/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2022/dsa-5085

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: cve@mitre.org

PatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2022/02/19/1