[SECURITY] [DSA 4472-1] expat security update

2019-06-2809:30:19

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

JSON

Debian Security Advisory DSA-4472-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
June 28, 2019 https://www.debian.org/security/faq

Package : expat
CVE ID : CVE-2018-20843
Debian Bug : 931031

It was discovered that Expat, an XML parsing C library, did not properly
handled XML input including XML names that contain a large number of
colons, potentially resulting in denial of service.

For the stable distribution (stretch), this problem has been fixed in
version 2.2.0-2+deb9u2.

We recommend that you upgrade your expat packages.

For the detailed security status of expat please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/expat

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian9i386lib64expat1-dbgsym< 2.2.0-2+deb9u2lib64expat1-dbgsym_2.2.0-2+deb9u2_i386.deb
Debian9amd64expat-dbgsym< 2.2.0-2+deb9u2expat-dbgsym_2.2.0-2+deb9u2_amd64.deb
Debian9ppc64elexpat-dbgsym< 2.2.0-2+deb9u2expat-dbgsym_2.2.0-2+deb9u2_ppc64el.deb
Debian8i386lib64expat1< 2.1.0-6+deb8u5lib64expat1_2.1.0-6+deb8u5_i386.deb
Debian8i386libexpat1< 2.1.0-6+deb8u5libexpat1_2.1.0-6+deb8u5_i386.deb
Debian9amd64libexpat1-udeb< 2.2.0-2+deb9u2libexpat1-udeb_2.2.0-2+deb9u2_amd64.deb
Debian8armhflibexpat1< 2.1.0-6+deb8u5libexpat1_2.1.0-6+deb8u5_armhf.deb
Debian9mips64elexpat-dbgsym< 2.2.0-2+deb9u2expat-dbgsym_2.2.0-2+deb9u2_mips64el.deb
Debian8armellibexpat1-udeb< 2.1.0-6+deb8u5libexpat1-udeb_2.1.0-6+deb8u5_armel.deb
Debian9s390xexpat-dbgsym< 2.2.0-2+deb9u2expat-dbgsym_2.2.0-2+deb9u2_s390x.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	i386	lib64expat1-dbgsym	< 2.2.0-2+deb9u2	lib64expat1-dbgsym_2.2.0-2+deb9u2_i386.deb
Debian	9	amd64	expat-dbgsym	< 2.2.0-2+deb9u2	expat-dbgsym_2.2.0-2+deb9u2_amd64.deb
Debian	9	ppc64el	expat-dbgsym	< 2.2.0-2+deb9u2	expat-dbgsym_2.2.0-2+deb9u2_ppc64el.deb
Debian	8	i386	lib64expat1	< 2.1.0-6+deb8u5	lib64expat1_2.1.0-6+deb8u5_i386.deb
Debian	8	i386	libexpat1	< 2.1.0-6+deb8u5	libexpat1_2.1.0-6+deb8u5_i386.deb
Debian	9	amd64	libexpat1-udeb	< 2.2.0-2+deb9u2	libexpat1-udeb_2.2.0-2+deb9u2_amd64.deb
Debian	8	armhf	libexpat1	< 2.1.0-6+deb8u5	libexpat1_2.1.0-6+deb8u5_armhf.deb
Debian	9	mips64el	expat-dbgsym	< 2.2.0-2+deb9u2	expat-dbgsym_2.2.0-2+deb9u2_mips64el.deb
Debian	8	armel	libexpat1-udeb	< 2.1.0-6+deb8u5	libexpat1-udeb_2.1.0-6+deb8u5_armel.deb
Debian	9	s390x	expat-dbgsym	< 2.2.0-2+deb9u2	expat-dbgsym_2.2.0-2+deb9u2_s390x.deb