[SECURITY] [DSA 3582-1] expat security update

2016-05-1805:18:57

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.008 Low

EPSS

Percentile

81.6%

JSON

Debian Security Advisory DSA-3582-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
May 18, 2016 https://www.debian.org/security/faq

Package : expat
CVE ID : CVE-2016-0718

Gustavo Grieco discovered that Expat, an XML parsing C library, does not
properly handle certain kinds of malformed input documents, resulting in
buffer overflows during processing and error reporting. A remote
attacker can take advantage of this flaw to cause an application using
the Expat library to crash, or potentially, to execute arbitrary code
with the privileges of the user running the application.

For the stable distribution (jessie), this problem has been fixed in
version 2.1.0-6+deb8u2. Additionally this update refreshes the fix for
CVE-2015-1283 to avoid relying on undefined behavior.

We recommend that you upgrade your expat packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian8armhfexpat< 2.1.0-6+deb8u2expat_2.1.0-6+deb8u2_armhf.deb
Debian8armellibexpat1-dev< 2.1.0-6+deb8u2libexpat1-dev_2.1.0-6+deb8u2_armel.deb
Debian8armhflibexpat1-udeb< 2.1.0-6+deb8u2libexpat1-udeb_2.1.0-6+deb8u2_armhf.deb
Debian8amd64libexpat1< 2.1.0-6+deb8u2libexpat1_2.1.0-6+deb8u2_amd64.deb
Debian7amd64libexpat1-dev< 2.1.0-1+deb7u3libexpat1-dev_2.1.0-1+deb7u3_amd64.deb
Debian7armellibexpat1-dev< 2.1.0-1+deb7u3libexpat1-dev_2.1.0-1+deb7u3_armel.deb
Debian8mipslibexpat1< 2.1.0-6+deb8u2libexpat1_2.1.0-6+deb8u2_mips.deb
Debian8powerpclibexpat1< 2.1.0-6+deb8u2libexpat1_2.1.0-6+deb8u2_powerpc.deb
Debian8s390xlibexpat1-dev< 2.1.0-6+deb8u2libexpat1-dev_2.1.0-6+deb8u2_s390x.deb
Debian7armhflibexpat1< 2.1.0-1+deb7u3libexpat1_2.1.0-1+deb7u3_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	armhf	expat	< 2.1.0-6+deb8u2	expat_2.1.0-6+deb8u2_armhf.deb
Debian	8	armel	libexpat1-dev	< 2.1.0-6+deb8u2	libexpat1-dev_2.1.0-6+deb8u2_armel.deb
Debian	8	armhf	libexpat1-udeb	< 2.1.0-6+deb8u2	libexpat1-udeb_2.1.0-6+deb8u2_armhf.deb
Debian	8	amd64	libexpat1	< 2.1.0-6+deb8u2	libexpat1_2.1.0-6+deb8u2_amd64.deb
Debian	7	amd64	libexpat1-dev	< 2.1.0-1+deb7u3	libexpat1-dev_2.1.0-1+deb7u3_amd64.deb
Debian	7	armel	libexpat1-dev	< 2.1.0-1+deb7u3	libexpat1-dev_2.1.0-1+deb7u3_armel.deb
Debian	8	mips	libexpat1	< 2.1.0-6+deb8u2	libexpat1_2.1.0-6+deb8u2_mips.deb
Debian	8	powerpc	libexpat1	< 2.1.0-6+deb8u2	libexpat1_2.1.0-6+deb8u2_powerpc.deb
Debian	8	s390x	libexpat1-dev	< 2.1.0-6+deb8u2	libexpat1-dev_2.1.0-6+deb8u2_s390x.deb
Debian	7	armhf	libexpat1	< 2.1.0-1+deb7u3	libexpat1_2.1.0-1+deb7u3_armhf.deb