USN-5320-1: Expat vulnerabilities and regression
10 March 2022
Several security issues and a regression were fixed in Expat.
Releases
Packages
- expat - XML parsing C library
Details
USN-5288-1 fixed several vulnerabilities in Expat. For CVE-2022-25236 it
caused a regression and an additional patch was required. This update address
this regression and several other vulnerabilities.
It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2022-25313)
It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a crash
or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-25314)
It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a crash or execute
arbitrary code. (CVE-2022-25315)
Original advisory details:
It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a crash or
execute arbitrary code. (CVE-2022-25236)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 21.10
Ubuntu 20.04
Ubuntu 18.04
Ubuntu 16.04
-
libexpat1
-
2.1.0-7ubuntu0.16.04.5+esm5
Available with Ubuntu Pro
-
lib64expat1
-
2.1.0-7ubuntu0.16.04.5+esm5
Available with Ubuntu Pro
Ubuntu 14.04
-
libexpat1
-
2.1.0-4ubuntu1.4+esm6
Available with Ubuntu Pro
-
lib64expat1
-
2.1.0-4ubuntu1.4+esm6
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.