Security
Headlines
HeadlinesLatestCVEs

Headline

RHSA-2022:4834: Red Hat Security Advisory: expat security update

An update for expat is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

  • CVE-2022-23852: expat: Integer overflow in function XML_GetBuffer
Red Hat Security Data
#vulnerability#web#linux#red_hat#nodejs#js#java#kubernetes#aws#ibm#sap

Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Containers
  • Support Cases

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Virtualization
  • Red Hat Identity Management
  • Red Hat Directory Server
  • Red Hat Certificate System
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Update Infrastructure
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat CloudForms
  • Red Hat OpenStack Platform
  • Red Hat OpenShift Container Platform
  • Red Hat OpenShift Data Science
  • Red Hat OpenShift Online
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • Red Hat CodeReady Workspaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat Single Sign On
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Thorntail
  • Red Hat build of Eclipse Vert.x
  • Red Hat build of OpenJDK
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Process Automation
  • Red Hat Process Automation Manager
  • Red Hat Decision Manager

All Products

Issued:

2022-05-31

Updated:

2022-05-31

RHSA-2022:4834 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Moderate: expat security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for expat is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, applications using the Expat library must be restarted for the update to take effect.

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
  • Red Hat Enterprise Linux Server - AUS 8.4 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.4 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
  • Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions 8.4 x86_64

Fixes

  • BZ - 2044613 - CVE-2022-23852 expat: Integer overflow in function XML_GetBuffer

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4

SRPM

expat-2.2.5-4.el8_4.3.src.rpm

SHA-256: e8c6a72d926906ae0bbb60b3d5330cf640a1573a41b909ca8fd643d305bba319

x86_64

expat-2.2.5-4.el8_4.3.i686.rpm

SHA-256: 86a5921f1b562eb5f0ff2af5372316895b01828d6b06b8ca10f55fd77dbc2918

expat-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: ef60a96d612a2d222318452174863b6113ee5e2e67321756ac28c93ba896899b

expat-debuginfo-2.2.5-4.el8_4.3.i686.rpm

SHA-256: d9764bd2510534baed541c07db3904ebe0917a1bf68ab5b543ac8353da04fc66

expat-debuginfo-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: 82510abd813b3c358d528b5e7a0050456e7c1fcef1769766454edac1700418cb

expat-debugsource-2.2.5-4.el8_4.3.i686.rpm

SHA-256: df93da4641b7285795c5cf749172db3b92c8161bd2ea3eb14b28d5f0c51c0876

expat-debugsource-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: 0814588b04a0f2dade7f6cba7dd15979d497209bc14518c586e1015917931411

expat-devel-2.2.5-4.el8_4.3.i686.rpm

SHA-256: 669cd53a51334c6ac2d971100e21c8c9b470d03056aa45c3a39063f04a0f8db7

expat-devel-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: fa03177f1ee6100b0f2d26fe2608c0a6650ddb891ff699f81629fe9e8c8cef59

Red Hat Enterprise Linux Server - AUS 8.4

SRPM

expat-2.2.5-4.el8_4.3.src.rpm

SHA-256: e8c6a72d926906ae0bbb60b3d5330cf640a1573a41b909ca8fd643d305bba319

x86_64

expat-2.2.5-4.el8_4.3.i686.rpm

SHA-256: 86a5921f1b562eb5f0ff2af5372316895b01828d6b06b8ca10f55fd77dbc2918

expat-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: ef60a96d612a2d222318452174863b6113ee5e2e67321756ac28c93ba896899b

expat-debuginfo-2.2.5-4.el8_4.3.i686.rpm

SHA-256: d9764bd2510534baed541c07db3904ebe0917a1bf68ab5b543ac8353da04fc66

expat-debuginfo-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: 82510abd813b3c358d528b5e7a0050456e7c1fcef1769766454edac1700418cb

expat-debugsource-2.2.5-4.el8_4.3.i686.rpm

SHA-256: df93da4641b7285795c5cf749172db3b92c8161bd2ea3eb14b28d5f0c51c0876

expat-debugsource-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: 0814588b04a0f2dade7f6cba7dd15979d497209bc14518c586e1015917931411

expat-devel-2.2.5-4.el8_4.3.i686.rpm

SHA-256: 669cd53a51334c6ac2d971100e21c8c9b470d03056aa45c3a39063f04a0f8db7

expat-devel-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: fa03177f1ee6100b0f2d26fe2608c0a6650ddb891ff699f81629fe9e8c8cef59

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4

SRPM

expat-2.2.5-4.el8_4.3.src.rpm

SHA-256: e8c6a72d926906ae0bbb60b3d5330cf640a1573a41b909ca8fd643d305bba319

s390x

expat-2.2.5-4.el8_4.3.s390x.rpm

SHA-256: 21b4e2bcf97e430550bc7ea7cf530e2aa0de01e520c0d6390c95e705c069eaf1

expat-debuginfo-2.2.5-4.el8_4.3.s390x.rpm

SHA-256: 8c956a0b7688a2f044163c3e57d605e97ce3eb2ad0a50d180868b279bdc2a1e2

expat-debugsource-2.2.5-4.el8_4.3.s390x.rpm

SHA-256: fdf344b20bddac5a99f78161134688747f638671c160b7a220fab1e95238fc94

expat-devel-2.2.5-4.el8_4.3.s390x.rpm

SHA-256: 6345f4b1228d7d233ac30d740b9006028dd074b248e2751daef18712a5a8301a

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4

SRPM

expat-2.2.5-4.el8_4.3.src.rpm

SHA-256: e8c6a72d926906ae0bbb60b3d5330cf640a1573a41b909ca8fd643d305bba319

ppc64le

expat-2.2.5-4.el8_4.3.ppc64le.rpm

SHA-256: fa0b2481d64dbdd4c32cda0cffec73c67e8ed6e53176ea127ce154deae838f28

expat-debuginfo-2.2.5-4.el8_4.3.ppc64le.rpm

SHA-256: e7cbf5cafdb51cb912b1fd36d7b0fed920162c9a989ff284283671f16c7567dd

expat-debugsource-2.2.5-4.el8_4.3.ppc64le.rpm

SHA-256: 0dee813aec360d3eca2598434920c0066f92883f66fb7e780eef4c1fbdcd1e9e

expat-devel-2.2.5-4.el8_4.3.ppc64le.rpm

SHA-256: 4355f41fb96a8a0be99867c92e4eb8d82a86ff7ed005e22a85e90fda62aaf44b

Red Hat Enterprise Linux Server - TUS 8.4

SRPM

expat-2.2.5-4.el8_4.3.src.rpm

SHA-256: e8c6a72d926906ae0bbb60b3d5330cf640a1573a41b909ca8fd643d305bba319

x86_64

expat-2.2.5-4.el8_4.3.i686.rpm

SHA-256: 86a5921f1b562eb5f0ff2af5372316895b01828d6b06b8ca10f55fd77dbc2918

expat-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: ef60a96d612a2d222318452174863b6113ee5e2e67321756ac28c93ba896899b

expat-debuginfo-2.2.5-4.el8_4.3.i686.rpm

SHA-256: d9764bd2510534baed541c07db3904ebe0917a1bf68ab5b543ac8353da04fc66

expat-debuginfo-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: 82510abd813b3c358d528b5e7a0050456e7c1fcef1769766454edac1700418cb

expat-debugsource-2.2.5-4.el8_4.3.i686.rpm

SHA-256: df93da4641b7285795c5cf749172db3b92c8161bd2ea3eb14b28d5f0c51c0876

expat-debugsource-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: 0814588b04a0f2dade7f6cba7dd15979d497209bc14518c586e1015917931411

expat-devel-2.2.5-4.el8_4.3.i686.rpm

SHA-256: 669cd53a51334c6ac2d971100e21c8c9b470d03056aa45c3a39063f04a0f8db7

expat-devel-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: fa03177f1ee6100b0f2d26fe2608c0a6650ddb891ff699f81629fe9e8c8cef59

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4

SRPM

expat-2.2.5-4.el8_4.3.src.rpm

SHA-256: e8c6a72d926906ae0bbb60b3d5330cf640a1573a41b909ca8fd643d305bba319

aarch64

expat-2.2.5-4.el8_4.3.aarch64.rpm

SHA-256: 6c7579607a25c2481c922b7993521d4bdb5fc3dffe4e0f5d60ec30b569a1bd8f

expat-debuginfo-2.2.5-4.el8_4.3.aarch64.rpm

SHA-256: 94ecc264267fdb25a64509979a6291e3ae355c0f6d6bbf65b63160bcb63090f2

expat-debugsource-2.2.5-4.el8_4.3.aarch64.rpm

SHA-256: 48731dc09e172a1d6300423f8ef5de8a721712d73862eee7d9df8cfee3467186

expat-devel-2.2.5-4.el8_4.3.aarch64.rpm

SHA-256: 35912affa73de40541a4fb4c4a8e7a322b3c5f49cf9dd46ee2dc0e14f06887fe

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4

SRPM

expat-2.2.5-4.el8_4.3.src.rpm

SHA-256: e8c6a72d926906ae0bbb60b3d5330cf640a1573a41b909ca8fd643d305bba319

ppc64le

expat-2.2.5-4.el8_4.3.ppc64le.rpm

SHA-256: fa0b2481d64dbdd4c32cda0cffec73c67e8ed6e53176ea127ce154deae838f28

expat-debuginfo-2.2.5-4.el8_4.3.ppc64le.rpm

SHA-256: e7cbf5cafdb51cb912b1fd36d7b0fed920162c9a989ff284283671f16c7567dd

expat-debugsource-2.2.5-4.el8_4.3.ppc64le.rpm

SHA-256: 0dee813aec360d3eca2598434920c0066f92883f66fb7e780eef4c1fbdcd1e9e

expat-devel-2.2.5-4.el8_4.3.ppc64le.rpm

SHA-256: 4355f41fb96a8a0be99867c92e4eb8d82a86ff7ed005e22a85e90fda62aaf44b

Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions 8.4

SRPM

expat-2.2.5-4.el8_4.3.src.rpm

SHA-256: e8c6a72d926906ae0bbb60b3d5330cf640a1573a41b909ca8fd643d305bba319

x86_64

expat-2.2.5-4.el8_4.3.i686.rpm

SHA-256: 86a5921f1b562eb5f0ff2af5372316895b01828d6b06b8ca10f55fd77dbc2918

expat-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: ef60a96d612a2d222318452174863b6113ee5e2e67321756ac28c93ba896899b

expat-debuginfo-2.2.5-4.el8_4.3.i686.rpm

SHA-256: d9764bd2510534baed541c07db3904ebe0917a1bf68ab5b543ac8353da04fc66

expat-debuginfo-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: 82510abd813b3c358d528b5e7a0050456e7c1fcef1769766454edac1700418cb

expat-debugsource-2.2.5-4.el8_4.3.i686.rpm

SHA-256: df93da4641b7285795c5cf749172db3b92c8161bd2ea3eb14b28d5f0c51c0876

expat-debugsource-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: 0814588b04a0f2dade7f6cba7dd15979d497209bc14518c586e1015917931411

expat-devel-2.2.5-4.el8_4.3.i686.rpm

SHA-256: 669cd53a51334c6ac2d971100e21c8c9b470d03056aa45c3a39063f04a0f8db7

expat-devel-2.2.5-4.el8_4.3.x86_64.rpm

SHA-256: fa03177f1ee6100b0f2d26fe2608c0a6650ddb891ff699f81629fe9e8c8cef59

The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.

Related news

CVE-2023-28864: Chef Infra Server Release Notes

Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to access sensitive information, resulting in the disclosure of all indexed node data, because OpenSearch credentials are exposed. (The data typically includes credentials for additional systems.) The attacker must wait for an admin to run the "chef-server-ctl reconfigure" command.

CVE-2023-28069: DSA-2022-258: Dell Streaming Data Platform Security Update for Multiple Third-Party Component Vulnerabilities

Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. An attacker with privileges same as a legitimate user can phish the legitimate the user to redirect to malicious website leading to information disclosure and launch of phishing attacks.

Scanvus now supports Vulners and Vulns.io VM Linux vulnerability detection APIs

Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]

Red Hat Security Advisory 2022-7144-01

Red Hat Security Advisory 2022-7144-01 - Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.51 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Service Pack 10, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include code execution, integer overflow, null pointer, out of bounds read, out of bounds write, and server-side request forgery vulnerabilities.

RHSA-2022:7143: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 security update

An update is now available for Red Hat JBoss Core Services. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-33193: httpd: Request splitting via HTTP/2 method injection and mod_proxy * CVE-2021-36160: httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path * CVE-2021-39275: httpd: Out-of-bounds write in ap_escape_quotes() via malicious input * CVE-2021-41524: httpd: NULL pointer dereference via crafted request during HTTP/2 request processing * CVE-202...

RHSA-2022:7144: Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 security update

An update is now available for Red Hat JBoss Core Services. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-33193: httpd: Request splitting via HTTP/2 method injection and mod_proxy * CVE-2021-36160: httpd: mod_proxy_uwsgi: out-of-bounds read via a crafted request uri-path * CVE-2021-39275: httpd: Out-of-bounds write in ap_escape_quotes() via malicious input * CVE-2021-41524: httpd: NULL pointer dereference via crafted request during HTTP/2 request processing * CVE-202...

CVE-2022-41587: October

Uncaptured exceptions in the home screen module. Successful exploitation of this vulnerability may affect stability.

RHSA-2022:6890: Red Hat Security Advisory: OpenShift Virtualization 4.8.7 Images bug fixes and security update

Red Hat OpenShift Virtualization release 4.8.7 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1798: kubeVirt: Arbitrary file read on the host from KubeVirt VMs

CVE-2022-20399: Android Security Bulletin—September 2022  |  Android Open Source Project

In the SEPolicy configuration of system apps, there is a possible access to the 'ip' utility due to an insecure default value. This could lead to local information disclosure of network data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-219808546References: Upstream kernel

CVE-2022-33932: DSA-2022-149: Dell EMC PowerScale OneFS Security Update for Multiple Vulnerabilities

Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain an unprotected primary channel vulnerability. An unauthenticated network malicious attacker may potentially exploit this vulnerability, leading to a denial of filesystem services.

CVE-2022-31238: DSA-2022-149: Dell EMC PowerScale OneFS Security Update for Multiple Vulnerabilities

Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.2, contain a process invoked with sensitive information vulnerability. A CLI user may potentially exploit this vulnerability, leading to information disclosure.

Red Hat Security Advisory 2022-5924-01

Red Hat Security Advisory 2022-5924-01 - Service Telemetry Framework provides automated collection of measurements and data from remote clients, such as Red Hat OpenStack Platform or third-party nodes. STF then transmits the information to a centralized, receiving Red Hat OpenShift Container Platform deployment for storage, retrieval, and monitoring.

CVE-2022-33923: DSA-2022-159: Dell PowerStore Family Security Update for Multiple Vulnerabilities

Dell PowerStore, versions prior to 3.0.0.0, contains an OS Command Injection vulnerability in PowerStore T environment. A locally authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS command on the PowerStore underlying OS. Exploiting may lead to a system take over by an attacker.

CVE-2022-29286: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling.

CVE-2022-27935: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth.

CVE-2022-27932: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.

CVE-2022-27931: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.

CVE-2022-27930: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique Identifier is guessed.

CVE-2022-27929: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP.

CVE-2022-27937: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.

CVE-2022-26657: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.

CVE-2022-26656: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join.

CVE-2022-26655: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gateway call into Teams.

CVE-2022-26654: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.

CVE-2022-25357: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity 27.x before 27.2 has Improper Access Control. An attacker can sometimes join a conference (call join) if it has a lock but not a PIN.

CVE-2022-27936: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.

CVE-2022-27934: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.

CVE-2022-27933: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.

CVE-2022-27928: Pexip security bulletins | Pexip Infinity Docs

Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.

Red Hat Security Advisory 2022-5483-01

Red Hat Security Advisory 2022-5483-01 - The Migration Toolkit for Containers enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Issues addressed include a denial of service vulnerability.

RHSA-2022:5483: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.2 security and bug fix update

The Migration Toolkit for Containers (MTC) 1.7.2 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2021-3807: nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes * CVE-2022-0235: node-fetch: exposure of sensitive information to an unauthorized actor * CVE-2022-0536: follow-redirects: Exposure of Sensitive Information via Authorization Header leak

CVE-2022-31229: DSA-2022-118: Dell EMC PowerScale OneFS Security Update

Dell PowerScale OneFS, 8.2.x through 9.3.0.x, contain an error message with sensitive information. An administrator could potentially exploit this vulnerability, leading to disclosure of sensitive information. This sensitive information can be used to access sensitive resources.

CVE-2022-31230: DSA-2022-118: Dell EMC PowerScale OneFS Security Update

Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker could potentially exploit this vulnerability, leading to full system access.

CVE-2022-32973: [R2] Nessus Version 10.2.0 Fixes Multiple Vulnerabilities

An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges.

CVE-2022-29085: DSA-2022-021: Dell Unity, Dell UnityVSA, and Dell Unity XT Security Update for Multiple Vulnerabilities

Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulnerability when certain off-array tools are run on the system. The credentials of a user with high privileges are stored in plain text. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user.

Red Hat Security Advisory 2022-4834-01

Red Hat Security Advisory 2022-4834-01 - Expat is a C library for parsing XML documents. Issues addressed include an integer overflow vulnerability.

Red Hat Security Advisory 2022-1747-01

Red Hat Security Advisory 2022-1747-01 - OpenShift Serverless version 1.22.0 contains a moderate security impact. The References section contains CVE links providing detailed severity ratings for each vulnerability.

CVE-2022-21496: Oracle Critical Patch Update Advisory - April 2022

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 7u331, 8u321, 11.0.14, 17.0.2, 18; Oracle GraalVM Enterprise Edition: 20.3.5, 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service ...

CVE-2022-23852: [CVE-2022-23852] Prevent XML_GetBuffer signed integer overflow by hartwork · Pull Request #550 · libexpat/libexpat

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.