Fluid Attacks Database

Description

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.14	expat	>=0 <2.4.5-r0	2.4.5-r0
alpine v3.15	expat	>=0 <2.4.5-r0	2.4.5-r0
alpine v3.16	expat	>=0 <2.4.5-r0	2.4.5-r0
alpine v3.17	expat	>=0 <2.4.5-r0	2.4.5-r0
alpine v3.18	expat	>=0 <2.4.5-r0	2.4.5-r0
alpine v3.19	expat	>=0 <2.4.5-r0	2.4.5-r0
alpine v3.20	expat	>=0 <2.4.5-r0	2.4.5-r0
alpine v3.21	expat	>=0 <2.4.5-r0	2.4.5-r0
alpine v3.22	expat	>=0 <2.4.5-r0	2.4.5-r0
debian 11	expat	=2.2.10-2 \|\| =2.2.10-2+deb11u1 \|\| >=0 <2.2.10-2+deb11u2	2.2.10-2+deb11u2

1-10 of 33

Aliases

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.