Veracode Vulnerability DatabaseVERACODE:21433Denial Of Service (Dos)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
libexpat.so is vulnerable to denial of service. A heap-based buffer overflow occurs when an attacker sends a malicious XML which switches the DTD parsing to document parsing immaturely, leading to repeated calls of XML_GetCurrentLineNumber or XML_GetCurrentColumnNumber function that results in an application crash.
References
lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html
lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html
lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html
lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html
lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html
lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html
lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html
lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html
lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html
lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html
lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html
lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html
packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html
packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html
packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html
seclists.org/fulldisclosure/2019/Dec/23
seclists.org/fulldisclosure/2019/Dec/26
seclists.org/fulldisclosure/2019/Dec/27
seclists.org/fulldisclosure/2019/Dec/30
access.redhat.com/errata/RHSA-2019:3210
access.redhat.com/errata/RHSA-2019:3237
access.redhat.com/errata/RHSA-2019:3756
github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43
github.com/libexpat/libexpat/issues/317
github.com/libexpat/libexpat/issues/342
github.com/libexpat/libexpat/pull/318
lists.debian.org/debian-lts-announce/2019/11/msg00006.html
lists.debian.org/debian-lts-announce/2019/11/msg00017.html
lists.fedoraproject.org/archives/list/[email protected]/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/
lists.fedoraproject.org/archives/list/[email protected]/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/
lists.fedoraproject.org/archives/list/[email protected]/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/
seclists.org/bugtraq/2019/Dec/17
seclists.org/bugtraq/2019/Dec/21
seclists.org/bugtraq/2019/Dec/23
seclists.org/bugtraq/2019/Nov/1
seclists.org/bugtraq/2019/Nov/24
seclists.org/bugtraq/2019/Oct/29
seclists.org/bugtraq/2019/Sep/30
seclists.org/bugtraq/2019/Sep/37
security.gentoo.org/glsa/201911-08
security.netapp.com/advisory/ntap-20190926-0004/
support.apple.com/kb/HT210785
support.apple.com/kb/HT210788
support.apple.com/kb/HT210789
support.apple.com/kb/HT210790
support.apple.com/kb/HT210793
support.apple.com/kb/HT210794
support.apple.com/kb/HT210795
usn.ubuntu.com/4132-1/
usn.ubuntu.com/4132-2/
usn.ubuntu.com/4165-1/
usn.ubuntu.com/4202-1/
usn.ubuntu.com/4335-1/
www.debian.org/security/2019/dsa-4530
www.debian.org/security/2019/dsa-4549
www.debian.org/security/2019/dsa-4571
www.oracle.com/security-alerts/cpuapr2020.html
www.oracle.com/security-alerts/cpuoct2020.html
www.tenable.com/security/tns-2021-11
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P