CVE-2022-23990

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-23990
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-23990.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-23990
Aliases
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CLEANSTART (5)
CLSA (6)
DEBIAN (1)
JLSEC (1)
MGASA (1)
OESA (1)
openSUSE (2)
RHBA (1)
RHSA (6)
SUSE (3)
UBUNTU (1)
Related
ALSA (1)
openSUSE (2)
SUSE (3)
Published
2022-01-26T18:02:02Z
Modified
2026-09-21T11:45:26Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23990.json"
}
References

Affected packages

Git / github.com/libexpat/libexpat

Affected ranges

Type
GIT
Repo
https://github.com/libexpat/libexpat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
81b89678e200820271b72cacdd45fb5868855765
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.4.4"
        }
    ],
    "source":  "DESCRIPTION"
}

Affected versions

Other
REC1_0
R_1_95_0
R_1_95_2
R_1_95_3
R_1_95_4
R_1_95_5
R_1_95_6
R_1_95_7
R_1_95_8
R_2_0_0
R_2_0_1
R_2_1_0
R_2_1_1
R_2_2_0
R_2_2_1
R_2_2_10
R_2_2_2
R_2_2_3
R_2_2_4
R_2_2_5
R_2_2_6
R_2_2_7
R_2_2_8
R_2_2_9
R_2_3_0
R_2_4_0
R_2_4_1
R_2_4_2
R_2_4_3
V1990307
V19981122
V19981231
V19990109
V19990425
V19990626
V19990709
V19990728
V19991013
V1_0
V1_1
V20000512
beta2
beta3
beta4
jclark-orig
libexpat-alpha-1
sourceforge_init
start

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-23990.json"