bugtraq - [SECURITY] [DSA 4530-1] expat security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1iBwV7-0000XA-Fh@seger.debian.org>
Date: Sun, 22 Sep 2019 07:41:45 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 4530-1] expat security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4530-1                   security@...ian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
September 22, 2019                    https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : expat
CVE ID         : CVE-2019-15903
Debian Bug     : 939394

It was discovered that Expat, an XML parsing C library, did not properly
handled internal entities closing the doctype, potentially resulting in
denial of service or information disclosure if a malformed XML file is
processed.

For the oldstable distribution (stretch), this problem has been fixed
in version 2.2.0-2+deb9u3.

For the stable distribution (buster), this problem has been fixed in
version 2.2.6-2+deb10u1.

We recommend that you upgrade your expat packages.

For the detailed security status of expat please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/expat

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl2HJHlfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0RrDg//d7+G9oQ9I1tIaopja+KfeJeAf9NN6qGTfemPeBoitDQhE6r7lIMB+/i7
r8yPIdTo6yt5u9KhJ2q2qnQjhaosqh5/Zus48K5lqrN+TMaoCjs/fMJBdWqXcnPv
5BsQyjelUVQ8aAiqGNfCSNIdmvDFbNic/x/bk1kqDXBQj145JMwkEz4hYsRf2HqD
tJYfnVEax3oD0L1RawW6PLUPKQ5lyWiwq+cXWA5lVNb4gIH1DZmVeUTlvbzgniz8
3WfwylztodKfTK139SsZGNM9wmmNZUmeBIBnlXGAW80fTZ6qI2XYmUevBCR4pVM8
SgHI2FxRqrbQjr9RX3u7Fnrwi+2weDQFxAncPSYBLzrJhoC/TdqhHsLXisYI6gFB
Bl3+fdnfh1KqYI/0JMVdee+aNM7N+macbvcwIOirYHwiB8MKC4mB4w5XO5CNjCb/
NGmt4rutAXWd2KL6ZiH9sqjnxnaqUCNjeXvVcSDzbnw9bS/aWu6G340+Idl9dLwE
RUPupv1eVILWbyy4lDSCqsvrvV3zbONkxG+QAZNmIOxe0PeriYtv3SrOXKfJxaut
eNnAruRTPvWE15doWKxAXTDD8A38rWoywWJFrWJ6P/X3TNPnbZfOvC4L6cOhqRnR
c1XThoFBS1DDgVRhgTsfWmSPodkoyWHNLwKr33qfabmw0NCxnLE=
=aD+U
-----END PGP SIGNATURE-----