Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Mageia 8: 2022-0409 Critical: Expat Use-After Free Issue

mageia
Calendar Grey November 4, 2022
Dist Mageia Esm H88
Mageia 2022-0409 includes a vital patch for libexpat, rectifying a serious vulnerability that poses risks to XML parsing integrity.
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations

Summary

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)

References

- https://bugs.mageia.org/show_bug.cgi?id=31057

- https://lists.debian.org/debian-security-announce/2022/msg00236.html

- https://www.cve.org/CVERecord?id=CVE-2022-43680

Topics%20covered

Topics Covered

security advisory critical update XML parsing Mageia use-after free libexpat

Resolution

SRPMS

- 8/core/expat-2.2.10-1.6.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 04 Nov 2022
URL: https://advisories.mageia.org/MGASA-2022-0409.html
Type: security
CVE: CVE-2022-43680

Topics%20covered

Topics Covered

security advisory critical update XML parsing Mageia use-after free libexpat

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here