TI-2022-09008 CVE-2022-25315 · GHSA-8w4r-jhg8-8rvj
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
Priority HIGH 82
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
RHSA-2022:7144
Red Hat JBoss Core Services Apache HTTP Server 2.4.51 security update
Released 2022-10-26 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Core Services
Fixes 21 records
TI-2021-19915 CVE-2021-44224 · GHSA-92ww-hwmg-qq7p
Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier
Priority HIGH 76
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be…
TI-2022-08947 CVE-2022-25236 · GHSA-3c6c-gjpg-qq92
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert…
Priority HIGH 75
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
TI-2021-20962 CVE-2021-45960 · GHSA-pfmv-2r4f-j9mj
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the…
Priority HIGH 73
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
TI-2018-15259 CVE-2018-25032 · GHSA-jc36-42cf-vqwj
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if…
Priority HIGH 72
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
TI-2021-21076 CVE-2021-46143 · GHSA-j6g2-cvhq-p8xr
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
Priority HIGH 70
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
TI-2021-16656 CVE-2021-39275 · GHSA-p59c-pqfv-4fwc
ap_escape_quotes buffer overflow
Priority HIGH 69
ap_escape_quotes() may write beyond the end of a buffer when given malicious input.
TI-2021-14579 CVE-2021-36160 · GHSA-f4wr-wvqf-r2q5
mod_proxy_uwsgi out of bound read
Priority HIGH 68
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS).
TI-2021-12741 CVE-2021-33193 · GHSA-p9fg-6rr5-38xc
Request splitting via HTTP/2 method injection and mod_proxy
Priority MEDIUM 63
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning.
TI-2022-08946 CVE-2022-25235 · GHSA-8mw4-grgw-m3fp
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding…
Priority MEDIUM 57
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
TI-2022-07855 CVE-2022-23852 · GHSA-h83g-c7g2-6r9h
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for…
Priority MEDIUM 57
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
TI-2022-07066 CVE-2022-22822 · GHSA-6rvw-hw83-3745
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Priority MEDIUM 57
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
TI-2022-07068 CVE-2022-22824 · GHSA-5pj8-9wmw-j96m
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Priority MEDIUM 55
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
TI-2022-07067 CVE-2022-22823 · GHSA-g654-6pp3-8m8w
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Priority MEDIUM 55
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
TI-2021-18264 CVE-2021-41524 · GHSA-f29c-hjcq-ww2f
null pointer dereference in h2 fuzzing
Priority MEDIUM 54
While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server.
TI-2022-09007 CVE-2022-25314 · GHSA-3qc2-95g6-46cj
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
Priority MEDIUM 47
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
TI-2022-07953 CVE-2022-23990 · GHSA-r3g2-gw56-v728
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
Priority MEDIUM 46
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
TI-2022-07071 CVE-2022-22827 · GHSA-97f8-83vc-c97q
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Priority MEDIUM 46
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
TI-2022-07070 CVE-2022-22826 · GHSA-q5xc-gwgw-8j5q
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Priority MEDIUM 46
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
TI-2022-07069 CVE-2022-22825 · GHSA-2h26-9fpg-gcx8
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Priority MEDIUM 46
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
TI-2022-09006 CVE-2022-25313 · GHSA-3gf2-723m-w3fv
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in…
Priority LOW 35
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.