Lucene search

K
debianDebianDEBIAN:DLA-1912-1:CAAA9
HistorySep 06, 2019 - 2:21 p.m.

[SECURITY] [DLA 1912-1] expat security update

2019-09-0614:21:17
lists.debian.org
53

Package : expat
Version : 2.1.0-6+deb8u6
CVE IDs : CVE-2019-15903
Debian Bug : #939394

It was discovered that there was a heap-based buffer overread
vulnerability in expat, an XML parsing library.

A specially-crafted XML input could fool the parser into changing
from DTD parsing to document parsing too early; a consecutive call to
XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then
resulted in a heap-based buffer overread.

For Debian 8 "Jessie", this issue has been fixed in expat version
2.1.0-6+deb8u6.

We recommend that you upgrade your expat packages.

Regards,


  ,''`.
 : :'  :     Chris Lamb
 `. `'`      [email protected] / chris-lamb.co.uk
   `-