CVE-2022-23852

CriticalCVSS 9.8/10Last modified Oct 14, 2026

Description

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5

References

https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdfThird Party Advisory
https://github.com/libexpat/libexpat/pull/550Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00007.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202209-24Third Party Advisory
https://security.netapp.com/advisory/ntap-20220217-0001/Third Party Advisory
https://www.debian.org/security/2022/dsa-5073Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlThird Party Advisory
https://www.tenable.com/security/tns-2022-05Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdfThird Party Advisory
https://github.com/libexpat/libexpat/pull/550Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00007.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202209-24Third Party Advisory
https://security.netapp.com/advisory/ntap-20220217-0001/Third Party Advisory
https://www.debian.org/security/2022/dsa-5073Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.htmlThird Party Advisory
https://www.tenable.com/security/tns-2022-05Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://cert-portal.siemens.com/productcert/html/ssa-484086.html

Timeline

Published: Jan 24, 2022
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-238537.8The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP serve CVE-2022-238547.5AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user CVE-2022-238559.8An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An authentication bypass in ECM/maintenance/forgotpasswordstep CVE-2022-238565.3An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An attacker can enumerate users by changing the id parameter, CVE-2022-238576.5model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An aut CVE-2022-238588.8A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system acc CVE-2022-23866.1The Crowdsignal Dashboard WordPress plugin before 3.0.8 does not sanitise and escape a parameter before outputting it back in the page, lead CVE-2022-238615.4Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web appl CVE-2022-238627.8A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JM CVE-2022-238636.5Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.CVE-2022-238659.8Nyron 1.0 is affected by a SQL injection vulnerability through Nyron/Library/Catalog/winlibsrch.aspx. To exploit this vulnerability, an atta CVE-2022-238687.8RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file.