1. Home
  2. Security Advisories
  3. Ubuntu
  4. USN-5455-1

[USN-5455-1] xmltok library vulnerabilities

Severity Critical
Affected Packages 8
CVEs 15
Info Packages Vulnerabilities

Several security issues were fixed in libxmltok.

Tim Boddy, Gustavo Grieco and others discovered that Expat, that is
integrated in xmltok library, incorrectly handled certain files.
An attacker could possibly use these issues to cause a denial of
service, or possibly execute arbitrary code. These issues were only
addressed in Ubuntu 16.04 ESM. (CVE-2012-1148, CVE-2015-1283,
CVE-2016-0718, CVE-2016-4472, CVE-2018-20843, CVE-2019-15903,
CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824,
CVE-2022-22825, CVE-2022-22826, CVE-2022-22827)

It was discovered that Expat, that is integrated in xmltok library,
incorrectly handled encoding validation of certain files. An attacker
could possibly use this issue to cause a denial of service, or
possibly execute arbitrary code. (CVE-2022-25235)

It was discovered that Expat, that is integrated in xmltok library,
incorrectly handled namespace URIs of certain files. An attacker
could possibly use this issue to cause a denial of service, or
possibly execute arbitrary code. (CVE-2022-25236)

Package Affected Version
pkg:deb/ubuntu/libxmltok1?distro=xenial < 1.2-3ubuntu0.16.04.1~esm2
pkg:deb/ubuntu/libxmltok1?distro=jammy < 1.2-4ubuntu0.22.04.1~esm1
pkg:deb/ubuntu/libxmltok1?distro=focal < 1.2-4ubuntu0.20.04.1~esm1
pkg:deb/ubuntu/libxmltok1?distro=bionic < 1.2-4ubuntu0.18.04.1~esm1
pkg:deb/ubuntu/libxmltok1-dev?distro=xenial < 1.2-3ubuntu0.16.04.1~esm2
pkg:deb/ubuntu/libxmltok1-dev?distro=jammy < 1.2-4ubuntu0.22.04.1~esm1
pkg:deb/ubuntu/libxmltok1-dev?distro=focal < 1.2-4ubuntu0.20.04.1~esm1
pkg:deb/ubuntu/libxmltok1-dev?distro=bionic < 1.2-4ubuntu0.18.04.1~esm1
ID
USN-5455-1
Severity
critical
Severity from
CVE-2016-0718
URL
https://ubuntu.com/security/notices/USN-5455-1
Published
2022-07-19T17:11:00
(2 years ago)
Modified
2022-07-19T17:11:00
(2 years ago)
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:deb/ubuntu/libxmltok1?distro=xenial ubuntu libxmltok1 < 1.2-3ubuntu0.16.04.1~esm2 xenial
Affected pkg:deb/ubuntu/libxmltok1?distro=jammy ubuntu libxmltok1 < 1.2-4ubuntu0.22.04.1~esm1 jammy
Affected pkg:deb/ubuntu/libxmltok1?distro=focal ubuntu libxmltok1 < 1.2-4ubuntu0.20.04.1~esm1 focal
Affected pkg:deb/ubuntu/libxmltok1?distro=bionic ubuntu libxmltok1 < 1.2-4ubuntu0.18.04.1~esm1 bionic
Affected pkg:deb/ubuntu/libxmltok1-dev?distro=xenial ubuntu libxmltok1-dev < 1.2-3ubuntu0.16.04.1~esm2 xenial
Affected pkg:deb/ubuntu/libxmltok1-dev?distro=jammy ubuntu libxmltok1-dev < 1.2-4ubuntu0.22.04.1~esm1 jammy
Affected pkg:deb/ubuntu/libxmltok1-dev?distro=focal ubuntu libxmltok1-dev < 1.2-4ubuntu0.20.04.1~esm1 focal
Affected pkg:deb/ubuntu/libxmltok1-dev?distro=bionic ubuntu libxmltok1-dev < 1.2-4ubuntu0.18.04.1~esm1 bionic
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date