Linux · Amazon Linux · Security advisory · February 17, 2023

ALAS2023-2023-058: Security update for 5 packages

ALAS2023-2023-058, released February 17, 2023, fixes 17 CVEs across 5 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
17
None rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.3527
98th percentile

Priority of the 17 CVEs

Patch now 0 Urgent 0 High 17 Routine 0

Fixed package versions

ProductReleaseFixed in
expatamzn 20232.5.0-1.amzn2023.0.2
expat-debuginfoamzn 20232.5.0-1.amzn2023.0.2
expat-debugsourceamzn 20232.5.0-1.amzn2023.0.2
expat-develamzn 20232.5.0-1.amzn2023.0.2
expat-staticamzn 20232.5.0-1.amzn2023.0.2

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2022-25236 libxmltok1: xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namesp...9.8 0.3527 None reported
High CVE-2022-22822 xul-ext-lightning: addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.9.8 0.0548 None reported
High CVE-2022-23852 expat: Expat (aka libexpat) before 2.4.4 has a signed integer overflow inXML_GetBuffer, for configurations with a nonzero XM...9.8 0.0508 None reported
High CVE-2022-25235 libxmltok1: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a...9.8 0.0496 None reported
High CVE-2022-25315 expat: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.9.8 0.0482 None reported
High CVE-2022-25314 expat: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.7.5 0.0482 None reported
High CVE-2022-23990 expat: Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.9.8 0.0469 None reported
High CVE-2021-45960 expat: In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) placesin the storeAtts function in xmlparse.c can...9.8 0.0467 None reported
High CVE-2021-46143 expat: In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integeroverflow exists for m_groupSize.9.8 0.0447 None reported
High CVE-2022-22823 thunderbird-mozsymbols: build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.9.8 0.0387 None reported
High CVE-2022-22824 expat: defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.9.8 0.0387 None reported
High CVE-2022-25313 expat: In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting dep...7.5 0.0330 None reported
High CVE-2022-22826 libxmltok1: nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.9.8 0.0318 None reported
High CVE-2022-22827 thunderbird-gnome-support: storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.9.8 0.0318 None reported
High CVE-2022-43680 expat: This update for expat fixes the following issues: - CVE-2025-59375: denial of service (resource consumption) cause...7.5 0.0318 None reported
High CVE-2022-22825 libxmltok1: lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.9.8 0.0299 None reported
High CVE-2022-40674 expat: libexpat before 2.4.9 has a use-after-free in the doContent function inxmlparse.c.8.1 0.0240 None reported
Showing 1 to 17 of 17 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.