Summary
Tim Boddy discovered that Expat, contained within the xmltok library, did
not properly handle memory reallocation when processing XML files. If a
user or application linked against Expat were tricked into opening a
crafted XML file, an attacker could cause a denial of service by consuming
excessive memory resources.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libxmltok | 1.2-4ubuntu0.18.04.1~esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libxmltok | 1.2-4ubuntu0.20.04.1~esm5 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libxmltok | 1.2-4ubuntu0.22.04.1~esm5 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | libxmltok | 1.2-4.1ubuntu2.24.0.4.1+esm3 |
Vulnerabilities 1
-
Unscored —
Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers t…
References
-
report
https://ubuntu.com/security/CVE-2012-1148