CVE:CVE-2022-23852
CNNVD:CNNVD-202201-2194
libexpat是一款使用C语言编写的流式XML解析器。
Libexpat 中存在输入验证错误漏洞，该漏洞源于产品的XML_GetBuffer未对有符号整数的范围做有效限制。攻击者可通过配置一个特殊的XML字节导致缓冲区溢出。以下产品及版本受到影响：Libexpat 2.4.4 之前版本。
solution:Upgrade libexpat_project libexpat to a higher version than 2.4.4,and avoid the version (,2.4.4); Upgrade netapp clustered_data_ontap to a higher version than -; Upgrade netapp oncommand_workflow_automation to a higher version than -; Upgrade tenable nessus to a higher version than 8.15.3,10.1.1,and avoid the version (,8.15.3),[10.0.0,10.1.1); Upgrade oracle communications_metasolv_solution to a higher version than 6.3.1,and avoid the version 6.3.1; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0; Upgrade siemens sinema_remote_connect_server to a higher version than 3.1,and avoid the version (,3.1)