DSA-5236: -1 expat -- security update
Published Sep 22, 2022
·Updated
expat - security update
Other sources
Rhodri James discovered a heap use-after-free vulnerability in the doContent function in Expat, an XML parsing C library, which could result in denial of service or potentially the execution of arbitrary code, if a malformed XML file is processed.
Affected Software
2 affected components
debian/expat
debian/expat
Event History
Sep 22, 2022
Advisory Published
12:00 AM
Frequently Asked Questions
1
What conditions are required to trigger this issue?
An application using Expat must process a malformed XML file. The issue is in Expat's doContent function and is triggered through crafted XML input.
2
What could exploitation allow?
Processing the malformed XML may cause a denial of service. The advisory also states that arbitrary code execution may be possible.
3
Which Debian software package is affected?
The affected software identified in the advisory is the Debian expat package.