Dirk Mueller
562a383c04
- Update to 2.4.1:
* Bug fixes:
- Autotools: Fix installed header expat_config.h for multilib
systems; regression introduced in 2.4.0 by pull request #486
* Other changes:
- Version info bumped from 9:0:8 to 9:1:8; see
https://verbump.de/ for what these numbers do
- Update to 2.4.0: [CVE-2013-0340 "Billion Laughs"]
* Security fixes:
- CVE-2013-0340/CWE-776 -- Protect against billion laughs attacks
(denial-of-service; flavors targeting CPU time or RAM or both,
leveraging general entities or parameter entities or both)
by tracking and limiting the input amplification factor
(<amplification> := (<direct> + <indirect>) / <direct>).
By conservative default, amplification up to a factor of 100.0
is tolerated and rejection only starts after 8 MiB of output bytes
(=<direct> + <indirect>) have been processed.
The fix adds the following to the API:
- A new error code XML_ERROR_AMPLIFICATION_LIMIT_BREACH to
signals this specific condition.
- Two new API functions ..
- XML_SetBillionLaughsAttackProtectionMaximumAmplification and
- XML_SetBillionLaughsAttackProtectionActivationThreshold
.. to further tighten billion laughs protection parameters
when desired. Please see file "doc/reference.html" for details.
If you ever need to increase the defaults for non-attack XML
payload, please file a bug report with libexpat.
- Two new XML_FEATURE_* constants ..
- that can be queried using the XML_GetFeatureList function, and
OBS-URL: https://build.opensuse.org/request/show/895213
OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/expat?expand=0&rev=88
17 lines
833 B
Plaintext
17 lines
833 B
Plaintext
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQIzBAABCAAdFiEEy43nCpDPv2w79cxWliYqz/vTrsYFAmCqgzgACgkQliYqz/vT
|
|
rsbPkxAAg/IYtwG35b0vmVAMbwQ4PPkh4mz6ZeqonakobUv2S1clObYmvwCAkqs/
|
|
SeLwRd2LEuXFfXriIScje78/R+NaNChod8Pq8cCup+HgKuC6S3I8ZHe/0f1Zk0D2
|
|
ofNXAEJ+vgNf3LsSAJrOnQ6wr2nx0zqWvuznh76WxbjV87x1+389JZdW7rnG9Hsw
|
|
Cd+BjsjysPk7Mt1QiNiV3FvRn/+uvfCbQwkMgo4ntQYZeia/8g2B1WLoTuU+lLtN
|
|
EmaZsQRQP4hSLiofDLYwhTJ0eeOdBD9taQrHf1cafFpI0ZXPrSHNMOa8f2PzFH0n
|
|
KNHtepdIrQZxxABF2tFOdGKUBuaRWqeRXT/dgZgbE9kZI0iRYb/4ADRh6sGXs9eP
|
|
8JW8OZxOHlGjpMPAiQBCEmfJAUKkzDxfKKuEcSi38yr3KmRK/uzLeoAgCyxIvr/i
|
|
Mx4yxsuCCi/xsCcEu0YZophYX0AJY2STzFE2PpXK/3dHUuwX50dCBasTKWTCqLXk
|
|
gFp0xJHAcSImo0VFwNsp9CKDUIL9NWafFQClIjG1SY201Z2l2uyp7iYRWiSBgQ2v
|
|
dc1nu2BH7ZnIYy/XuCjGIXaf/qLBOphSjKdy58Zp9NOCPgFiIP3W2CtyAV5sk+Nh
|
|
fg1R9LHqYr8KfofpdA+sUJ5HByyVTnB1s4xLsq2DGP6rIExrONw=
|
|
=xupO
|
|
-----END PGP SIGNATURE-----
|