安全公告详情

NS-SA-2023-0070

2023-05-26 13:38:39

简介

important: expat security update

严重级别

important

主题

An update for expat is now available for NewStart CGSL MAIN 5.04.
NewStart Security has rated this update as having a security impact of important. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.

详细描述

expat: The expat-devel package contains the libraries, include files and documentation to develop XML applications with expat.


Security Fix(es):
expat: A vulnerability was found in expat. With this flaw, it is possible to create a situation in which parsing is suspended while substituting in an internal entity so that XML_ResumeParser directly uses the internalEntityProcessor as its processor. If the subsequent parse includes some unclosed tags, this will return without calling storeRawNames to ensure that the raw versions of the tag names are stored in memory other than the parse buffer itself. Issues occur if the parse buffer is changed or reallocated (for example, if processing a file line by line), problems occur. Using this vulnerability in the doContent function allows an attacker to triage a denial of service or potentially arbitrary code execution.(CVE-2022-40674)
expat: bugfix


Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 5.04.F49B5.

影响组件

  • expat

影响产品

  • CGSL MAIN 5.04

更新包

{"fix":[{"product":"CGSL MAIN 5.04","pkgs":[{"binary":["expat-2.1.0-15.el7_9.x86_64.rpm","expat-static-2.1.0-15.el7_9.x86_64.rpm","expat-devel-2.1.0-15.el7_9.x86_64.rpm","expat-debuginfo-2.1.0-15.el7_9.x86_64.rpm"],"source":"expat-2.1.0-15.el7_9.src.rpm"}]}]}
CGSL MAIN 5.04
  • expat-2.1.0-15.el7_9.src.rpm
    • expat-2.1.0-15.el7_9.x86_64.rpm
    • expat-static-2.1.0-15.el7_9.x86_64.rpm
    • expat-devel-2.1.0-15.el7_9.x86_64.rpm
    • expat-debuginfo-2.1.0-15.el7_9.x86_64.rpm

CVE

参考

© 2004-2023 广东中兴新支点技术有限公司 版权所有 (www.gd-linux.com) 粤ICP备15061780号-2

全国服务热线:400-033-0108