Ubuntu 5320-1: Expat vulnerabilities and regression | LinuxSecurity...
==========================================================================
Ubuntu Security Notice USN-5320-1
March 10, 2022

expat vulnerabilities and regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 21.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM
- Ubuntu 14.04 ESM

Summary:

Several security issues and a regression were fixed in Expat.

Software Description:
- expat: XML parsing C library

Details:

USN-5288-1 fixed several vulnerabilities in Expat. For CVE-2022-25236 it
caused a regression and an additional patch was required. This update address
this regression and several other vulnerabilities.

It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2022-25313)

It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a crash
or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-25314)

It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a crash or execute
arbitrary code. (CVE-2022-25315)

Original advisory details:

 It was discovered that Expat incorrectly handled certain files.
 An attacker could possibly use this issue to cause a crash or
 execute arbitrary code. (CVE-2022-25236)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  libexpat1                       2.4.1-2ubuntu0.3

Ubuntu 20.04 LTS:
  libexpat1                       2.2.9-1ubuntu0.4

Ubuntu 18.04 LTS:
  libexpat1                       2.2.5-3ubuntu0.7

Ubuntu 16.04 ESM:
  lib64expat1                     2.1.0-7ubuntu0.16.04.5+esm5
  libexpat1                       2.1.0-7ubuntu0.16.04.5+esm5

Ubuntu 14.04 ESM:
  lib64expat1                     2.1.0-4ubuntu1.4+esm6
  libexpat1                       2.1.0-4ubuntu1.4+esm6

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-5320-1
  CVE-2022-25313, CVE-2022-25314, CVE-2022-25315, https://launchpad.net/bugs/1963903

Package Information:
  https://launchpad.net/ubuntu/+source/expat/2.4.1-2ubuntu0.3
  https://launchpad.net/ubuntu/+source/expat/2.2.9-1ubuntu0.4
  https://launchpad.net/ubuntu/+source/expat/2.2.5-3ubuntu0.7

Ubuntu 5320-1: Expat vulnerabilities and regression

March 10, 2022

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 ESM - Ubuntu 14.04 ESM Summary: Several security issues and a regression were fixed in Expat. Software Description: - expat: XML parsing C library Details: USN-5288-1 fixed several vulnerabilities in Expat. For CVE-2022-25236 it caused a regression and an additional patch was required. This update address this regression and several other vulnerabilities. It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2022-25313) It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-25314) It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2022-25315) Original advisory details: It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code. (CVE-2022-25236)

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 21.10: libexpat1 2.4.1-2ubuntu0.3 Ubuntu 20.04 LTS: libexpat1 2.2.9-1ubuntu0.4 Ubuntu 18.04 LTS: libexpat1 2.2.5-3ubuntu0.7 Ubuntu 16.04 ESM: lib64expat1 2.1.0-7ubuntu0.16.04.5+esm5 libexpat1 2.1.0-7ubuntu0.16.04.5+esm5 Ubuntu 14.04 ESM: lib64expat1 2.1.0-4ubuntu1.4+esm6 libexpat1 2.1.0-4ubuntu1.4+esm6 In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5320-1

CVE-2022-25313, CVE-2022-25314, CVE-2022-25315, https://launchpad.net/bugs/1963903

Severity
Ubuntu Security Notice USN-5320-1

Package Information

https://launchpad.net/ubuntu/+source/expat/2.4.1-2ubuntu0.3 https://launchpad.net/ubuntu/+source/expat/2.2.9-1ubuntu0.4 https://launchpad.net/ubuntu/+source/expat/2.2.5-3ubuntu0.7

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.