CVE-2022-40152

Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
References
Link Resource
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434 Exploit Permissions Required Third Party Advisory
https://github.com/x-stream/xstream/issues/304 Issue Tracking Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:fasterxml:woodstox:*:*:*:*:*:*:*:*
cpe:2.3:a:fasterxml:woodstox:*:*:*:*:*:*:*:*

History

09 Feb 2023, 01:36

Type Values Removed Values Added
CPE cpe:2.3:a:fasterxml:woodstox:*:*:*:*:*:*:*:*
First Time Fasterxml
Fasterxml woodstox

25 Nov 2022, 11:15

Type Values Removed Values Added
Summary Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack. Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.

20 Sep 2022, 18:12

Type Values Removed Values Added
CPE cpe:2.3:a:xstream_project:xstream:*:*:*:*:*:*:*:*
First Time Xstream Project xstream
Xstream Project
References (CONFIRM) https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434 - (CONFIRM) https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47434 - Exploit, Permissions Required, Third Party Advisory
References (CONFIRM) https://github.com/x-stream/xstream/issues/304 - (CONFIRM) https://github.com/x-stream/xstream/issues/304 - Issue Tracking, Third Party Advisory
CWE CWE-787
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5

16 Sep 2022, 10:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-09-16 10:15

Updated : 2023-12-10 14:35


NVD link : CVE-2022-40152

Mitre link : CVE-2022-40152

CVE.ORG link : CVE-2022-40152


JSON object : View

Products Affected

xstream_project

  • xstream

fasterxml

  • woodstox
CWE
CWE-787

Out-of-bounds Write

CWE-121

Stack-based Buffer Overflow