[USN-5320-1] Expat vulnerabilities and regression

[Leonidas S. Barbosa]

==========================================================================
Ubuntu Security Notice USN-5320-1
March 10, 2022

expat vulnerabilities and regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 21.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM
- Ubuntu 14.04 ESM

Summary:

Several security issues and a regression were fixed in Expat.

Software Description:
- expat: XML parsing C library

Details:

USN-5288-1 fixed several vulnerabilities in Expat. For CVE-2022-25236 it
caused a regression and an additional patch was required. This update address
this regression and several other vulnerabilities.

It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2022-25313)

It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a crash
or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-25314)

It was discovered that Expat incorrectly handled certain files.
An attacker could possibly use this issue to cause a crash or execute
arbitrary code. (CVE-2022-25315)

Original advisory details:

 It was discovered that Expat incorrectly handled certain files.
 An attacker could possibly use this issue to cause a crash or
 execute arbitrary code. (CVE-2022-25236)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  libexpat1                       2.4.1-2ubuntu0.3

Ubuntu 20.04 LTS:
  libexpat1                       2.2.9-1ubuntu0.4

Ubuntu 18.04 LTS:
  libexpat1                       2.2.5-3ubuntu0.7

Ubuntu 16.04 ESM:
  lib64expat1                     2.1.0-7ubuntu0.16.04.5+esm5
  libexpat1                       2.1.0-7ubuntu0.16.04.5+esm5

Ubuntu 14.04 ESM:
  lib64expat1                     2.1.0-4ubuntu1.4+esm6
  libexpat1                       2.1.0-4ubuntu1.4+esm6

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-5320-1
  CVE-2022-25313, CVE-2022-25314, CVE-2022-25315, https://launchpad.net/bugs/1963903

Package Information:
  https://launchpad.net/ubuntu/+source/expat/2.4.1-2ubuntu0.3
  https://launchpad.net/ubuntu/+source/expat/2.2.9-1ubuntu0.4
  https://launchpad.net/ubuntu/+source/expat/2.2.5-3ubuntu0.7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20220310/b9a6486e/attachment.sig>