expat/expat-2.4.3.tar.xz.asc

Accepting request 947286 from home:dirkmueller:Factory - update to 2.4.3 (bsc#1194251, bsc#1194362, bsc#1194474, bsc#1194476, bsc#1194477, bsc#1194478, bsc#1194479, bsc#1194480): * CVE-2021-45960 -- Fix issues with left shifts by >=29 places resulting in a) realloc acting as free b) realloc allocating too few bytes c) undefined behavior depending on architecture and precise value for XML documents with >=2^27+1 prefixed attributes on a single XML tag a la "<r xmlns:a='[..]' a:a123='[..]' [..] />" where XML_ParserCreateNS is used to create the parser (which needs argument "-n" when running xmlwf). Impact is denial of service, or more. * CVE-2021-46143 (ZDI-CAN-16157) -- Fix integer overflow on variable m_groupSize in function doProlog leading to realloc acting as free. Impact is denial of service or more. * CVE-2022-22822 to CVE-2022-22827 -- Prevent integer overflows near memory allocation at multiple places. Mitre assigned a dedicated CVE for each involved internal C function: - CVE-2022-22822 for function addBinding - CVE-2022-22823 for function build_model - CVE-2022-22824 for function defineAttribute - CVE-2022-22825 for function lookup - CVE-2022-22826 for function nextScaffoldPart - CVE-2022-22827 for function storeAtts Impact is denial of service or more. OBS-URL: https://build.opensuse.org/request/show/947286 OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/expat?expand=0&rev=91 2022-01-18 23:15:40 +01:00			`-----BEGIN PGP SIGNATURE-----`

			`iQIzBAABCAAdFiEEy43nCpDPv2w79cxWliYqz/vTrsYFAmHkI5AACgkQliYqz/vT`
			`rsaDyg//Uz2cyoYU79ndQt2jI+zaq58KGhyqHt1CfjPp8jCjhTlkTcFsmE8ftzaa`
			`1IpI+CKyGatiFh8mIy7Pq+V9nOJkyfmp6t0QCaa/eE7ngOHAz8PDEwj4ievY1aBx`
			`2dvvwLLrtXaIYhj48v1/xmpCCXUL0os0BIqs6WWl6l0mE3ba1J6AITnZytp1zPy9`
			`NfaVxRirqA6z8n3TpMZ0FvLXGC0e9aRkE6vR+EQvHmTzdbvJhi0kXhjVIL72QR2R`
			`9MrpoBD+Wyq+c4wE2otqJWj5Cazb2Ri5uVsoCHGHOGRSFPW4g+7dQC+dK9O+pzQ9`
			`c/BlmLQTkmgkSLQbKSsFAociaKEe7ef1tXqxTEpsqqbfC9GqVKGfkDzSoigQfJbl`
			`sKXXZvXVj/6LxhioKTEEAHZ21Z8a2qG3Q+g4Trd7uAPIrz2wQwwkB+TF1i8HAeRy`
			`q8nNTPbbAmtFe2NuetyZeTaUbPHZAuxl7hH8JnsFs5vTUdP5C9xxGXU7c6xXRL1H`
			`qKH60WPSxNUxtaiprTrWsyaKX4z3cQRp2pp0wf1M9m4jPWPSpi8SSkZu/C3xhNIz`
			`U+cs3Ile+ctQSpx8R1nV3VE71NecjW7dkgnU29JkmCohpobAfWPJJMBopTNzPRCW`
			`JxRLuQ//kpt7OnuNsaI/Ko3MTyvmP82Ynup1u8HrfTnLTFCT3Ic=`
			`=26Td`
			`-----END PGP SIGNATURE-----`