pool/expat
SHA256
12
0
Fork 3
Code Issues Pull Requests Activity

Accepting request 956000 from home:david.anes:branches:devel:libraries:c_c++

Browse Source 
- update to 2.4.5 (bsc#1196171, bsc#1196169, bsc#1196168, 
  bsc#1196026, bsc#1196025):
    * Security fixes:
      - CVE-2022-25235 -- Passing malformed 2- and 3-byte UTF-8
        sequences (e.g. from start tag names) to the XML
        processing application on top of Expat can cause
        arbitrary damage (e.g. code execution) depending
        on how invalid UTF-8 is handled inside the XML
        processor; validation was not their job but Expat's.
        Exploits with code execution are known to exist.
      - CVE-2022-25236 -- Passing (one or more) namespace separator
        characters in "xmlns[:prefix]" attribute values
        made Expat send malformed tag names to the XML
        processor on top of Expat which can cause
        arbitrary damage (e.g. code execution) depending
        on such unexpectable cases are handled inside the XML
        processor; validation was not their job but Expat's.
        Exploits with code execution are known to exist.
      - CVE-2022-25313 -- Fix stack exhaustion in doctype parsing
        that could be triggered by e.g. a 2 megabytes
        file with a large number of opening braces.
        Expected impact is denial of service or potentially
        arbitrary code execution.
      - CVE-2022-25314 -- Fix integer overflow in function copyString;
        only affects the encoding name parameter at parser creation
        time which is often hardcoded (rather than user input),
        takes a value in the gigabytes to trigger, and a 64-bit
        machine.  Expected impact is denial of service.
      - CVE-2022-25315 -- Fix integer overflow in function storeRawNames;
        needs input in the gigabytes and a 64-bit machine.

OBS-URL: https://build.opensuse.org/request/show/956000
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/expat?expand=0&rev=93
This commit is contained in:
Dirk Mueller
2022-02-20 16:05:20 +00:00
committed by Git OBS Bridge
parent c847592a56
commit 4587d04dec
6 changed files with 60 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
expat.changes
View File

@@ -1,3 +1,42 @@
-------------------------------------------------------------------
Sat Feb 19 09:21:21 UTC 2022 - David Anes <david.anes@suse.com>
- update to 2.4.5 (bsc#1196171, bsc#1196169, bsc#1196168,
bsc#1196026, bsc#1196025):
* Security fixes:
- CVE-2022-25235 -- Passing malformed 2- and 3-byte UTF-8
sequences (e.g. from start tag names) to the XML
processing application on top of Expat can cause
arbitrary damage (e.g. code execution) depending
on how invalid UTF-8 is handled inside the XML
processor; validation was not their job but Expat's.
Exploits with code execution are known to exist.
- CVE-2022-25236 -- Passing (one or more) namespace separator
characters in "xmlns[:prefix]" attribute values
made Expat send malformed tag names to the XML
processor on top of Expat which can cause
arbitrary damage (e.g. code execution) depending
on such unexpectable cases are handled inside the XML
processor; validation was not their job but Expat's.
Exploits with code execution are known to exist.
- CVE-2022-25313 -- Fix stack exhaustion in doctype parsing
that could be triggered by e.g. a 2 megabytes
file with a large number of opening braces.
Expected impact is denial of service or potentially
arbitrary code execution.
- CVE-2022-25314 -- Fix integer overflow in function copyString;
only affects the encoding name parameter at parser creation
time which is often hardcoded (rather than user input),
takes a value in the gigabytes to trigger, and a 64-bit
machine. Expected impact is denial of service.
- CVE-2022-25315 -- Fix integer overflow in function storeRawNames;
needs input in the gigabytes and a 64-bit machine.
Expected impact is denial of service or potentially
arbitrary code execution.
* Other changes:
- Version info bumped from 9:4:8 to 9:5:8;
see https://verbump.de/ for what these numbers do
-------------------------------------------------------------------
Mon Jan 31 06:13:13 UTC 2022 - David Anes <david.anes@suse.com>