DSA-4530: -1 expat -- security update

Published Sep 22, 2019

Updated

expat - security update

Other sources

It was discovered that Expat, an XML parsing C library, did not properly handled internal entities closing the doctype, potentially resulting in denial of service or information disclosure if a malformed XML file is processed.

Affected Software

2 affected components

debian/expat

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade expat to a version that resolves this vulnerability.
Patch DSA-4530-1

Event History

Sep 22, 2019

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2019-15903

Frequently Asked Questions

What does an attacker need to provide to trigger the issue?

The vulnerable application must process a malformed XML file involving internal entities that close the document type declaration (DOCTYPE).

Which systems are in scope?

The advisory applies to Debian's expat package. Exposure depends on whether software using that library processes attacker-controlled XML.

Does this advisory identify affected or fixed package versions?

No affected or fixed version numbers are provided in the advisory data.