Debian CVE-2022-40674: expat: a use-after-free in the doContent function

[Yue Tao]

CVE-2022-40674: [https://nvd.nist.gov/vuln/detail/CVE-2022-40674]
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Score:
cve_id status cvss3Score av ac pr ui ai
CVE-2022-40674 fixed 9.8 N L N N H

References:
https://security-tracker.debian.org/tracker/DSA-5236-1

['libexpat1_2.2.10-2+deb11u3_amd64.deb===>libexpat1_2.2.10-2+deb11u4_amd64.deb', 'libexpat1-dev_2.2.10-2+deb11u3_amd64.deb===>libexpat1-dev_2.2.10-2+deb11u4_amd64.deb']

Found during September 2022 CVE scan using vulscan

[Ghada Khalil (gkhalil)]

screening: stx.8.0 / medium - CVE meets the stx fix criteria

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/864162

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/864162
Committed: https://opendev.org/starlingx/tools/commit/2ee522337b2bf3cd8c70448f52b09c7678251ba4
Submitter: "Zuul (22348)"
Branch: master

commit 2ee522337b2bf3cd8c70448f52b09c7678251ba4
Author: Yue Tao <email address hidden>
Date: Thu Nov 10 14:37:56 2022 +0800

    Debian: expat: fix CVE-2022-40674

    Upgrade libexpat1 to 2.2.10-2+deb11u4
    Upgrade libexpat1-dev to 2.2.10-2+deb11u4

    Refer to:
    https://security-tracker.debian.org/tracker/CVE-2022-40674

    Test Plan:

    Pass: build all
    Pass: boot

    Closes-Bug: 1994107

    Signed-off-by: Yue Tao <email address hidden>
    Change-Id: Id27696a2c1e0bc8ae86c3238a0774a6e2b0407e4