CVE Vulnerabilities


Use After Free

Published: Sep 14, 2022 | Modified: Feb 01, 2023
CVSS 3.x
CVSS 2.x

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.


Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Affected Software

Name Vendor Start Version End Version
Libexpat Libexpat_project * *
Apache2 Ubuntu trusty *
Apache2 Ubuntu xenial *
Apr-util Ubuntu trusty *
Apr-util Ubuntu xenial *
Ayttm Ubuntu trusty *
Ayttm Ubuntu xenial *
Cableswig Ubuntu trusty *
Cableswig Ubuntu xenial *
Cadaver Ubuntu bionic *
Cadaver Ubuntu kinetic *
Cadaver Ubuntu trusty *
Cadaver Ubuntu xenial *
Cmake Ubuntu trusty *
Cmake Ubuntu xenial *
Coin3 Ubuntu bionic *
Coin3 Ubuntu kinetic *
Coin3 Ubuntu trusty *
Coin3 Ubuntu xenial *
Expat Ubuntu bionic *
Expat Ubuntu devel *
Expat Ubuntu esm-infra/bionic *
Expat Ubuntu esm-infra/xenial *
Expat Ubuntu focal *
Expat Ubuntu jammy *
Expat Ubuntu kinetic *
Expat Ubuntu lunar *
Expat Ubuntu trusty *
Expat Ubuntu trusty/esm *
Expat Ubuntu xenial *
Firefox Ubuntu bionic *
Firefox Ubuntu focal *
Firefox Ubuntu trusty *
Firefox Ubuntu xenial *
Gdcm Ubuntu bionic *
Gdcm Ubuntu kinetic *
Gdcm Ubuntu trusty *
Gdcm Ubuntu xenial *
Ghostscript Ubuntu trusty *
Ghostscript Ubuntu xenial *
Insighttoolkit Ubuntu trusty *
Insighttoolkit Ubuntu xenial *
Insighttoolkit4 Ubuntu trusty *
Insighttoolkit4 Ubuntu xenial *
Libxmltok Ubuntu bionic *
Libxmltok Ubuntu kinetic *
Libxmltok Ubuntu trusty *
Matanza Ubuntu bionic *
Matanza Ubuntu kinetic *
Matanza Ubuntu trusty *
Matanza Ubuntu xenial *
Smart Ubuntu bionic *
Smart Ubuntu trusty *
Smart Ubuntu xenial *
Swish-e Ubuntu bionic *
Swish-e Ubuntu kinetic *
Swish-e Ubuntu trusty *
Swish-e Ubuntu xenial *
Tdom Ubuntu bionic *
Tdom Ubuntu kinetic *
Tdom Ubuntu trusty *
Tdom Ubuntu xenial *
Texlive-bin Ubuntu trusty *
Texlive-bin Ubuntu xenial *
Thunderbird Ubuntu bionic *
Thunderbird Ubuntu devel *
Thunderbird Ubuntu focal *
Thunderbird Ubuntu jammy *
Thunderbird Ubuntu kinetic *
Thunderbird Ubuntu lunar *
Thunderbird Ubuntu trusty *
Thunderbird Ubuntu xenial *
Vnc4 Ubuntu bionic *
Vnc4 Ubuntu trusty *
Vnc4 Ubuntu xenial *
Vtk Ubuntu trusty *
Vtk Ubuntu xenial *
Wbxml2 Ubuntu bionic *
Wbxml2 Ubuntu kinetic *
Wbxml2 Ubuntu trusty *
Wbxml2 Ubuntu xenial *
Xmlrpc-c Ubuntu bionic *
Xmlrpc-c Ubuntu kinetic *
Xmlrpc-c Ubuntu trusty *
Xmlrpc-c Ubuntu xenial *

Extended Description

The use of previously-freed memory can have any number of adverse consequences, ranging from the corruption of valid data to the execution of arbitrary code, depending on the instantiation and timing of the flaw. The simplest way data corruption may occur involves the system’s reuse of the freed memory. Use-after-free errors have two common and sometimes overlapping causes:

In this scenario, the memory in question is allocated to another pointer validly at some point after it has been freed. The original pointer to the freed memory is used again and points to somewhere within the new allocation. As the data is changed, it corrupts the validly used memory; this induces undefined behavior in the process. If the newly allocated data happens to hold a class, in C++ for example, various function pointers may be scattered within the heap data. If one of these function pointers is overwritten with an address to valid shellcode, execution of arbitrary code can be achieved.

Potential Mitigations