Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
XML-RPC Expat Crashes or Code Execution
published 2 months ago
Summary
The XML-RPC component in certain systems contains a flaw in the way it handles certain files. This could allow an attacker to intentionally make the system crash or run malicious code. It's essential to update or patch the affected systems to prevent potential issues.
What to do
- Update canonical xmlrpc-c to version 1.33.06-0ubuntu1+esm1.
- Update canonical xmlrpc-c to version 1.33.14-1ubuntu1+esm1.
- Update canonical xmlrpc-c to version 1.33.14-8ubuntu0.18.04.1~esm1.
- Update canonical xmlrpc-c to version 1.33.14-8ubuntu0.20.04.1~esm1.
- Update canonical xmlrpc-c to version 1.33.14-10ubuntu0.1~esm1.
- Update canonical xmlrpc-c to version 1.33.14-12ubuntu0.1~esm1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | xmlrpc-c |
< 1.33.06-0ubuntu1+esm1 Fix: upgrade to 1.33.06-0ubuntu1+esm1
|
| Ubuntu:Pro:16.04:LTS | canonical | xmlrpc-c |
< 1.33.14-1ubuntu1+esm1 Fix: upgrade to 1.33.14-1ubuntu1+esm1
|
| Ubuntu:Pro:18.04:LTS | canonical | xmlrpc-c |
< 1.33.14-8ubuntu0.18.04.1~esm1 Fix: upgrade to 1.33.14-8ubuntu0.18.04.1~esm1
|
| Ubuntu:Pro:20.04:LTS | canonical | xmlrpc-c |
< 1.33.14-8ubuntu0.20.04.1~esm1 Fix: upgrade to 1.33.14-8ubuntu0.20.04.1~esm1
|
| Ubuntu:Pro:22.04:LTS | canonical | xmlrpc-c |
< 1.33.14-10ubuntu0.1~esm1 Fix: upgrade to 1.33.14-10ubuntu0.1~esm1
|
| Ubuntu:Pro:24.04:LTS | canonical | xmlrpc-c |
< 1.33.14-12ubuntu0.1~esm1 Fix: upgrade to 1.33.14-12ubuntu0.1~esm1
|
Original advisory text
xmlrpc-c vulnerabilities
It was discovered that Expat, vendored in XML-RPC, incorrectly handled
certain files. An attacker could possibly use this issue to cause a crash
or execute arbitrary code.
certain files. An attacker could possibly use this issue to cause a crash
or execute arbitrary code.
References
- https://ubuntu.com/security/notices/USN-8313-1 Vendor Advisory
- https://ubuntu.com/security/CVE-2022-25235 Third Party Advisory
- https://ubuntu.com/security/CVE-2022-25236 Third Party Advisory
Timeline
Published27 May 2026
Updated27 May 2026
First seen27 May 2026
Sources
USN-8313-1 · OSV
Monitor software like this
Free during beta