Linux · Security advisory · November 8, 2022

ALSA-2022:7692: Security update for 5 packages

ALSA-2022:7692, released November 8, 2022, fixes 7 CVEs across 5 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
7
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0548
92nd percentile

Priority of the 7 CVEs

Patch now 0 Urgent 0 High 7 Routine 0

Fixed package versions

ProductReleaseFixed in
xmlrpc-calmalinux 81.51.0-8.el8
xmlrpc-c-c++almalinux 81.51.0-8.el8
xmlrpc-c-clientalmalinux 81.51.0-8.el8
xmlrpc-c-client++almalinux 81.51.0-8.el8
xmlrpc-c-develalmalinux 81.51.0-8.el8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2022-22822 xul-ext-lightning: addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. 9.8 0.0548 None reported
High CVE-2021-46143 expat: In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integeroverflow exists for m_groupSize. 9.8 0.0447 None reported
High CVE-2022-22823 thunderbird-mozsymbols: build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. 9.8 0.0387 None reported
High CVE-2022-22824 expat: defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. 9.8 0.0387 None reported
High CVE-2022-22826 libxmltok1: nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. 9.8 0.0318 None reported
High CVE-2022-22827 thunderbird-gnome-support: storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. 9.8 0.0318 None reported
High CVE-2022-22825 libxmltok1: lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. 9.8 0.0299 None reported
Showing 1 to 7 of 7 1