USN-3010-1 — expat vulnerabilities

Summary

It was discovered that Expat unexpectedly called srand in certain
circumstances. This could reduce the security of calling applications.
(CVE-2012-6702)

It was discovered that Expat incorrectly handled seeding the random number
generator. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2016-5300)

Fixed packages 2

Release	Package	Fixed in
Ubuntu · 14.04 LTS 14.04:LTS	expat	2.1.0-4ubuntu1.3
Ubuntu · 16.04 LTS 16.04:LTS	expat	2.1.0-7ubuntu0.16.04.2

Vulnerabilities 2

Unscored —

CVE-2012-6702

Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-…

expat xmlrpc-c vnc4 expat Debian Ubuntu Alpine

Jun 16, 2016
Unscored —

CVE-2016-5300

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attacke…

expat xmlrpc-c vnc4 expat Debian Ubuntu Alpine

Jun 16, 2016

References

report
https://ubuntu.com/security/CVE-2012-6702
report
https://ubuntu.com/security/CVE-2016-5300

expat vulnerabilities

Summary

Fixed packages 2

Vulnerabilities 2

Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-…

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attacke…

References