PT-2012-1122 · Expat+7 · Expat+7
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
expat versions prior to 2.1.0
Description
The issue is related to multiple vulnerabilities in the expat package, which can lead to a disruption of protected information availability. These vulnerabilities can be exploited remotely. A memory leak in the poolGrow function in expat/lib/xmlparse.c allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.
Recommendations
For expat versions prior to 2.1.0, update to version 2.1.0 or later to resolve the issue. As a temporary workaround, consider restricting the processing of XML files to minimize the risk of exploitation. Avoid using the
poolGrow function in the expat/lib/xmlparse.c file until the issue is resolved.Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Centos
Debian
Linuxmint
Red Hat
Suse
Ubuntu
Expat
Itunes