organicmaps/libexpat
13
Fork 0
mirror of https://github.com/libexpat/libexpat.git synced 2025-04-14 16:20:45 +00:00
Code Issues 1 Projects Releases Wiki Activity Actions 19

Changes: Document CVE-2022-25235

Browse source
This commit is contained in:
Sebastian Pipping 2022-02-08 17:18:00 +01:00
parent 6a5510bc6b
commit c16300f0bc
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
expat/Changes
View file

@ -4,6 +4,13 @@ NOTE: We are looking for help with a few things:
Release X.X.X XXX XXXXXXX XX XXXX
Security fixes:
#562 CVE-2022-25235 -- Passing malformed 2- and 3-byte UTF-8
sequences (e.g. from start tag names) to the XML
processing application on top of Expat can cause
arbitrary damage (e.g. code execution) depending
on how invalid UTF-8 is handled inside the XML
processor; validation was not their job but Expat's.
Exploits with code execution are known to exist.
#561 CVE-2022-25236 -- Passing (one or more) namespace separator
characters in "xmlns[:prefix]" attribute values
made Expat send malformed tag names to the XML