Hitachi Energy AFS65x,AFF66x, AFS67x, and AFR67x Series Products
In Expat (aka libexpat) before 2.4.3, a left shift by 29(or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. Vulnerable code using addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Vulnerable code using build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow Vulnerable code using defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. The lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. Vulnerable code using nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string. In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames Vulnerable code in xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. Vulnerable code in xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.