[SECURITY] [DLA 990-1] expat security update

2017-06-1801:54:29

lists.debian.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

8.9

Confidence

High

EPSS

0.003

Percentile

69.8%

JSON

Package : expat
Version : 2.1.0-1+deb7u5
CVE ID : CVE-2017-9233

It was discovered that there was an infinite loop vulnerability in expat, a XML
parsing C library:

https://libexpat.github.io/doc/cve-2017-9233/

For Debian 7 "Wheezy", this issue has been fixed in expat version
2.1.0-1+deb7u5.

We recommend that you upgrade your expat packages.

Regards,

  ,&#x27;&#x27;`.
 : :&#x27;  :     Chris Lamb
 `. `&#x27;`      [email protected] / chris-lamb.co.uk
   `-

OSVersionArchitecturePackageVersionFilename
Debian8kfreebsd-i386libexpat1-dev< 2.1.0-6+deb8u4libexpat1-dev_2.1.0-6+deb8u4_kfreebsd-i386.deb
Debian8mipslibexpat1-udeb< 2.1.0-6+deb8u4libexpat1-udeb_2.1.0-6+deb8u4_mips.deb
Debian9amd64expat< 2.2.0-2+deb9u1expat_2.2.0-2+deb9u1_amd64.deb
Debian8arm64libexpat1-dev< 2.1.0-6+deb8u4libexpat1-dev_2.1.0-6+deb8u4_arm64.deb
Debian8amd64expat< 2.1.0-6+deb8u4expat_2.1.0-6+deb8u4_amd64.deb
Debian9ppc64ellibexpat1-udeb< 2.2.0-2+deb9u1libexpat1-udeb_2.2.0-2+deb9u1_ppc64el.deb
Debian8s390xlibexpat1-udeb< 2.1.0-6+deb8u4libexpat1-udeb_2.1.0-6+deb8u4_s390x.deb
Debian9mipsexpat-dbgsym< 2.2.0-2+deb9u1expat-dbgsym_2.2.0-2+deb9u1_mips.deb
Debian8powerpclibexpat1-udeb< 2.1.0-6+deb8u4libexpat1-udeb_2.1.0-6+deb8u4_powerpc.deb
Debian7amd64libexpat1< 2.1.0-1+deb7u5libexpat1_2.1.0-1+deb7u5_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	kfreebsd-i386	libexpat1-dev	< 2.1.0-6+deb8u4	libexpat1-dev_2.1.0-6+deb8u4_kfreebsd-i386.deb
Debian	8	mips	libexpat1-udeb	< 2.1.0-6+deb8u4	libexpat1-udeb_2.1.0-6+deb8u4_mips.deb
Debian	9	amd64	expat	< 2.2.0-2+deb9u1	expat_2.2.0-2+deb9u1_amd64.deb
Debian	8	arm64	libexpat1-dev	< 2.1.0-6+deb8u4	libexpat1-dev_2.1.0-6+deb8u4_arm64.deb
Debian	8	amd64	expat	< 2.1.0-6+deb8u4	expat_2.1.0-6+deb8u4_amd64.deb
Debian	9	ppc64el	libexpat1-udeb	< 2.2.0-2+deb9u1	libexpat1-udeb_2.2.0-2+deb9u1_ppc64el.deb
Debian	8	s390x	libexpat1-udeb	< 2.1.0-6+deb8u4	libexpat1-udeb_2.1.0-6+deb8u4_s390x.deb
Debian	9	mips	expat-dbgsym	< 2.2.0-2+deb9u1	expat-dbgsym_2.2.0-2+deb9u1_mips.deb
Debian	8	powerpc	libexpat1-udeb	< 2.1.0-6+deb8u4	libexpat1-udeb_2.1.0-6+deb8u4_powerpc.deb
Debian	7	amd64	libexpat1	< 2.1.0-1+deb7u5	libexpat1_2.1.0-1+deb7u5_amd64.deb