DSA-4472: -1 expat -- security update

Published Jun 28, 2019

Updated

expat - security update

Other sources

It was discovered that Expat, an XML parsing C library, did not properly handled XML input including XML names that contain a large number of colons, potentially resulting in denial of service.

Affected Software

2 affected components

debian/expat

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade expat to a version that resolves this vulnerability.
Patch DSA-4472-1

Event History

Jun 28, 2019

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2018-20843

Frequently Asked Questions

What kind of XML input can trigger the denial of service?

The issue is triggered by XML names containing a large number of colons. Processing such input can cause a denial of service in Expat.

What must an attacker be able to do to exploit this issue?

An attacker would need to supply crafted XML input to an application that uses the affected Expat XML parsing library.

How can I determine whether this advisory applies to my systems?

Check whether the system uses the Debian expat package and whether applications on it parse XML input that may be attacker-controlled.