USN-5638-4 — expat vulnerabilities

Summary

USN-5638-1 fixed several vulnerabilities in Expat. This update provides
the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Rhodri James discovered that Expat incorrectly handled memory when
processing certain malformed XML files. An attacker could possibly
use this issue to cause a crash or execute arbitrary code.

Fixed packages 1

Release	Package	Fixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	expat	2.1.0-4ubuntu1.4+esm7

Vulnerabilities 2

High 8.1

CVE-2022-40674

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Sep 14, 2022
High 7.5

CVE-2022-43680 Public exploit

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnt…

thunderbird insighttoolkit4 expat swish-e Debian Ubuntu Azure Linux Alpine

Oct 24, 2022

References

report
https://ubuntu.com/security/CVE-2022-40674
report
https://ubuntu.com/security/CVE-2022-43680

expat vulnerabilities

Summary

Fixed packages 1

Vulnerabilities 2

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnt…

References