Log in Start free

Vulnerability · Published Oct 24, 2022 · Assigned by mitre

CVE-2022-43680

High 7.5

In plain English

A high-severity use-after-free in the expat package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.2%top 11.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8expat2.2.5-10.el8_7.1ALSA-2023:0103
AlmaLinux:9expat2.4.9-1.el9_1.1ALSA-2023:0337
AlmaLinux:8expat-devel2.2.5-10.el8_7.1ALSA-2023:0103
AlmaLinux:9expat-devel2.4.9-1.el9_1.1ALSA-2023:0337
Alpine:v3.20expat2.5.0-r0ALPINE-CVE-2022-43680
Alpine:v3.21expat2.5.0-r0ALPINE-CVE-2022-43680
Alpine:v3.22expat2.5.0-r0ALPINE-CVE-2022-43680
Alpine:v3.23expat2.5.0-r0ALPINE-CVE-2022-43680
Alpine:v3.24expat2.5.0-r0ALPINE-CVE-2022-43680
Debian:12expat2.5.0-1DEBIAN-CVE-2022-43680
Debian:13expat2.5.0-1DEBIAN-CVE-2022-43680
Debian:14expat2.5.0-1DEBIAN-CVE-2022-43680
Debian:12libxmltokno fix listedDEBIAN-CVE-2022-43680
Rocky Linux:8expat0:2.2.5-10.el8_7.1RLSA-2023:0103
Rocky Linux:9expat0:2.4.9-1.el9_1.1RLSA-2023:0337
Ubuntu:22.04:LTScadaverno fix listedUBUNTU-CVE-2022-43680
Ubuntu:24.04:LTScadaverno fix listedUBUNTU-CVE-2022-43680
Ubuntu:25.10cadaverno fix listedUBUNTU-CVE-2022-43680
Ubuntu:26.04:LTScadaverno fix listedUBUNTU-CVE-2022-43680
Ubuntu:26.10cadaverno fix listedUBUNTU-CVE-2022-43680
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.1USN-5638-2
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.2UBUNTU-CVE-2022-43680
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.2USN-5638-3
Ubuntu:22.04:LTSmatanzano fix listedUBUNTU-CVE-2022-43680
Ubuntu:24.04:LTSmatanzano fix listedUBUNTU-CVE-2022-43680
Ubuntu:25.10matanzano fix listedUBUNTU-CVE-2022-43680
Ubuntu:26.04:LTSmatanzano fix listedUBUNTU-CVE-2022-43680
Ubuntu:26.10matanzano fix listedUBUNTU-CVE-2022-43680
Ubuntu:25.10swish-eno fix listedUBUNTU-CVE-2022-43680
Ubuntu:26.10swish-eno fix listedUBUNTU-CVE-2022-43680
Ubuntu:22.04:LTStdomno fix listedUBUNTU-CVE-2022-43680
Ubuntu:24.04:LTStdomno fix listedUBUNTU-CVE-2022-43680
Ubuntu:25.10tdomno fix listedUBUNTU-CVE-2022-43680
Ubuntu:26.04:LTStdomno fix listedUBUNTU-CVE-2022-43680
Ubuntu:26.10tdomno fix listedUBUNTU-CVE-2022-43680
Ubuntu:22.04:LTSthunderbirdno fix listedUBUNTU-CVE-2022-43680
Ubuntu:24.04:LTSthunderbirdno fix listedUBUNTU-CVE-2022-43680
Ubuntu:25.10thunderbirdno fix listedUBUNTU-CVE-2022-43680
Ubuntu:26.04:LTSthunderbirdno fix listedUBUNTU-CVE-2022-43680
Ubuntu:26.10thunderbirdno fix listedUBUNTU-CVE-2022-43680
Ubuntu:22.04:LTSwbxml2no fix listedUBUNTU-CVE-2022-43680
Ubuntu:24.04:LTSwbxml2no fix listedUBUNTU-CVE-2022-43680
Ubuntu:25.10wbxml2no fix listedUBUNTU-CVE-2022-43680
Ubuntu:26.04:LTSwbxml2no fix listedUBUNTU-CVE-2022-43680
Ubuntu:26.10wbxml2no fix listedUBUNTU-CVE-2022-43680
Ubuntu:25.10xmlrpc-cno fix listedUBUNTU-CVE-2022-43680
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2022-43680
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2022-43680

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References