Arch Linux alert ASA-201707-27 (lib32-expat)
| From: | Remi Gacogne <rgacogne@archlinux.org> | |
| To: | arch-security@archlinux.org | |
| Subject: | [arch-security] [ASA-201707-27] lib32-expat: denial of service | |
| Date: | Thu, 27 Jul 2017 11:01:55 +0200 | |
| Message-ID: | <a9a0a76d-23e3-f21c-4c9e-714e2add2370@archlinux.org> |
Arch Linux Security Advisory ASA-201707-27 ========================================== Severity: Medium Date : 2017-07-26 CVE-ID : CVE-2016-9063 CVE-2017-9233 Package : lib32-expat Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-305 Summary ======= The package lib32-expat before version 2.2.2-1 is vulnerable to denial of service. Resolution ========== Upgrade to 2.2.2-1. # pacman -Syu "lib32-expat>=2.2.2-1" The problems have been fixed upstream in version 2.2.2. Workaround ========== None. Description =========== - CVE-2016-9063 (denial of service) An integer overflow vulnerability has been discovered during the parsing of XML using the Expat library. - CVE-2017-9233 (denial of service) An external entity infinite loop issue has been found in Expat < 2.2.1, leading to a denial of service. Impact ====== An attacker can cause a denial of service in an application using lib32-expat by sending a crafted XML payload. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa201... https://github.com/libexpat/libexpat/commit/d4f735b88d993... https://libexpat.github.io/doc/cve-2017-9233/ https://security.archlinux.org/CVE-2016-9063 https://security.archlinux.org/CVE-2017-9233