DSA-1953-1 expat -- denial of service

Debian Security Advisory

DSA-1953-1 expat -- denial of service

Date Reported:

15 Dec 2009

Affected Packages:

expat

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 560901.
In Mitre's CVE dictionary: CVE-2009-3560.

More information:

Jan Lieskovsky discovered an error in expat, an XML parsing C library, when parsing certain UTF-8 sequences, which can be exploited to crash an application using the library.

For the oldstable distribution (etch), this problem has been fixed in version 1.95.8-3.4+etch4.

For the stable distribution (lenny), this problem has been fixed in version 2.0.1-4+lenny2.

For the testing distribution (squeeze) and the unstable distribution (sid), this problem will be in version 2.0.1-6.

The builds for the mipsel architecture for the oldstable distribution are not included yet. They will be released when they become available.

We recommend that you upgrade your expat packages.

Fixed in:

Debian GNU/Linux 4.0 (etch)

Source:

http://security.debian.org/pool/updates/main/e/expat/expat_1.95.8-3.4+etch4.diff.gz

http://security.debian.org/pool/updates/main/e/expat/expat_1.95.8.orig.tar.gz

http://security.debian.org/pool/updates/main/e/expat/expat_1.95.8-3.4+etch4.dsc

Alpha:

http://security.debian.org/pool/updates/main/e/expat/libexpat1_1.95.8-3.4+etch4_alpha.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_1.95.8-3.4+etch4_alpha.udeb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_1.95.8-3.4+etch4_alpha.deb

http://security.debian.org/pool/updates/main/e/expat/expat_1.95.8-3.4+etch4_alpha.deb

AMD64:

http://security.debian.org/pool/updates/main/e/expat/libexpat1_1.95.8-3.4+etch4_amd64.deb

http://security.debian.org/pool/updates/main/e/expat/expat_1.95.8-3.4+etch4_amd64.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_1.95.8-3.4+etch4_amd64.udeb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_1.95.8-3.4+etch4_amd64.deb

ARM:

http://security.debian.org/pool/updates/main/e/expat/libexpat1_1.95.8-3.4+etch4_arm.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_1.95.8-3.4+etch4_arm.deb

http://security.debian.org/pool/updates/main/e/expat/expat_1.95.8-3.4+etch4_arm.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_1.95.8-3.4+etch4_arm.udeb

HP Precision:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_1.95.8-3.4+etch4_hppa.deb

http://security.debian.org/pool/updates/main/e/expat/expat_1.95.8-3.4+etch4_hppa.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_1.95.8-3.4+etch4_hppa.udeb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_1.95.8-3.4+etch4_hppa.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/e/expat/libexpat1_1.95.8-3.4+etch4_i386.deb

http://security.debian.org/pool/updates/main/e/expat/expat_1.95.8-3.4+etch4_i386.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_1.95.8-3.4+etch4_i386.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_1.95.8-3.4+etch4_i386.udeb

Intel IA-64:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_1.95.8-3.4+etch4_ia64.udeb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_1.95.8-3.4+etch4_ia64.deb

http://security.debian.org/pool/updates/main/e/expat/expat_1.95.8-3.4+etch4_ia64.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_1.95.8-3.4+etch4_ia64.deb

Big-endian MIPS:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_1.95.8-3.4+etch4_mips.udeb

http://security.debian.org/pool/updates/main/e/expat/expat_1.95.8-3.4+etch4_mips.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_1.95.8-3.4+etch4_mips.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_1.95.8-3.4+etch4_mips.deb

PowerPC:

http://security.debian.org/pool/updates/main/e/expat/expat_1.95.8-3.4+etch4_powerpc.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_1.95.8-3.4+etch4_powerpc.udeb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_1.95.8-3.4+etch4_powerpc.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_1.95.8-3.4+etch4_powerpc.deb

IBM S/390:

http://security.debian.org/pool/updates/main/e/expat/libexpat1_1.95.8-3.4+etch4_s390.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_1.95.8-3.4+etch4_s390.udeb

http://security.debian.org/pool/updates/main/e/expat/expat_1.95.8-3.4+etch4_s390.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_1.95.8-3.4+etch4_s390.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_1.95.8-3.4+etch4_sparc.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_1.95.8-3.4+etch4_sparc.udeb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_1.95.8-3.4+etch4_sparc.deb

http://security.debian.org/pool/updates/main/e/expat/expat_1.95.8-3.4+etch4_sparc.deb

Debian GNU/Linux 5.0 (lenny)

Source:

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1.orig.tar.gz

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2.dsc

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2.diff.gz

Alpha:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_2.0.1-4+lenny2_alpha.udeb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_2.0.1-4+lenny2_alpha.deb

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2_alpha.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny2_alpha.deb

AMD64:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_2.0.1-4+lenny2_amd64.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_2.0.1-4+lenny2_amd64.udeb

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2_amd64.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny2_amd64.deb

ARM:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_2.0.1-4+lenny2_arm.udeb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_2.0.1-4+lenny2_arm.deb

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2_arm.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny2_arm.deb

ARM EABI:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_2.0.1-4+lenny2_armel.deb

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2_armel.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_2.0.1-4+lenny2_armel.udeb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny2_armel.deb

HP Precision:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_2.0.1-4+lenny2_hppa.udeb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_2.0.1-4+lenny2_hppa.deb

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2_hppa.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny2_hppa.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_2.0.1-4+lenny2_i386.udeb

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2_i386.deb

http://security.debian.org/pool/updates/main/e/expat/lib64expat1-dev_2.0.1-4+lenny2_i386.deb

http://security.debian.org/pool/updates/main/e/expat/lib64expat1_2.0.1-4+lenny2_i386.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_2.0.1-4+lenny2_i386.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny2_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2_ia64.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny2_ia64.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_2.0.1-4+lenny2_ia64.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_2.0.1-4+lenny2_ia64.udeb

Big-endian MIPS:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_2.0.1-4+lenny2_mips.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_2.0.1-4+lenny2_mips.udeb

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2_mips.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny2_mips.deb

Little-endian MIPS:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_2.0.1-4+lenny2_mipsel.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny2_mipsel.deb

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2_mipsel.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_2.0.1-4+lenny2_mipsel.udeb

PowerPC:

http://security.debian.org/pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny2_powerpc.deb

http://security.debian.org/pool/updates/main/e/expat/lib64expat1_2.0.1-4+lenny2_powerpc.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_2.0.1-4+lenny2_powerpc.deb

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2_powerpc.deb

http://security.debian.org/pool/updates/main/e/expat/lib64expat1-dev_2.0.1-4+lenny2_powerpc.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_2.0.1-4+lenny2_powerpc.udeb

IBM S/390:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_2.0.1-4+lenny2_s390.deb

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2_s390.deb

http://security.debian.org/pool/updates/main/e/expat/lib64expat1_2.0.1-4+lenny2_s390.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny2_s390.deb

http://security.debian.org/pool/updates/main/e/expat/lib64expat1-dev_2.0.1-4+lenny2_s390.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_2.0.1-4+lenny2_s390.udeb

Sun Sparc:

http://security.debian.org/pool/updates/main/e/expat/libexpat1-udeb_2.0.1-4+lenny2_sparc.udeb

http://security.debian.org/pool/updates/main/e/expat/lib64expat1_2.0.1-4+lenny2_sparc.deb

http://security.debian.org/pool/updates/main/e/expat/expat_2.0.1-4+lenny2_sparc.deb

http://security.debian.org/pool/updates/main/e/expat/lib64expat1-dev_2.0.1-4+lenny2_sparc.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1_2.0.1-4+lenny2_sparc.deb

http://security.debian.org/pool/updates/main/e/expat/libexpat1-dev_2.0.1-4+lenny2_sparc.deb

MD5 checksums of the listed files are available in the original advisory.