ELSA-2022-9227 — Important: expat security update (Oracle Linux 7)

Summary

[2.1.0-12.0.1]
- lib: Prevent integer overflow on groupSize [CVE-2021-46143][Orabug: 33910302]
- lib: Prevent integer overflow in doProlog [CVE-2022-23990][Orabug: 33910302]

Fixed packages 3

Release	Package	Fixed in
Oracle Linux · 7	expat	0:2.1.0-12.0.1.el7
Oracle Linux · 7	expat-devel	0:2.1.0-12.0.1.el7
Oracle Linux · 7	expat-static	0:2.1.0-12.0.1.el7

Vulnerabilities 2

High 8.1

CVE-2021-46143 Public exploit

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

firefox insighttoolkit4 qtwebengine-opensource-src expat Debian Ubuntu Azure Linux Alpine

Jan 6, 2022
High 7.5

CVE-2022-23990 Public exploit

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

thunderbird firefox expat swish-e Debian Ubuntu Azure Linux Alpine

Jan 26, 2022

Important: expat security update (Oracle Linux 7)

Summary

Fixed packages 3

Vulnerabilities 2

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.