CVE-2022-23990

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

In Expat (libexpat) before 2.4.5, there is an integer overflow in copyString.

In xmlparse.c in Expat (aka libexpat) before 2.4.5, attackers can insert namespace-separator characters into namespace URIs.

In xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

The defineAttribute function in xmlparse.c in Expat (libexpat) before 2.4.3 has an integer overflow. This may lead to incorrect behavior of the XML parser.

The build_model function in xmlparse.c in Expat (libexpat) before 2.4.3 has an integer overflow. This may lead to incorrect behavior of the XML parser.

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

In Expat (libexpat) before 2.4.3, a left shift by 29 or more bits in the storeAtts function in xmlparse.c can lead to realloc misbehavior, such as allocating too few bytes or only freeing memory.

In libexpat (Expat before 2.2.7), XML input including XML names with a large number of colons could make the parser consume high amounts of RAM and CPU resources, enough for denial-of-service attacks.