expat: CVE-2013-0340

Debian Bug report logs - #1001864
expat: CVE-2013-0340

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Devalla, Manoj Raj" <ManojRaj.Devalla@Cerner.com>

To: "submit@bugs.debian.org" <submit@bugs.debian.org>

Subject: expat: CVE-2013-0340

Date: Fri, 17 Dec 2021 22:33:32 +0000

[Message part 1 (text/plain, inline)]

Package: expat
Version: 2.2.10-2
Severity: important
Tags: security upstream

Hi,


The following vulnerability was published for expat.



CVE-2013-0340[0]:

| expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of

| service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because

| expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be

| REJECTed, and each affected application would need its own CVE.



If you fix the vulnerability please also make sure to include the

CVE (Common Vulnerabilities & Exposures) id in your changelog entry.



Current OS: Debian GNU/Linux 11



For further information see:



[0] https://nvd.nist.gov/vuln/detail/CVE-2013-0340



Please adjust the affected versions in the BTS as needed.



Regards,

Raj



CONFIDENTIALITY NOTICE This message and any included attachments are from Cerner Corporation and are intended only for the addressee. The information contained in this message is confidential and may constitute inside or non-public information under international, federal, or state securities laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee, please promptly delete this message and notify the sender of the delivery error by e-mail or you may call Cerner's corporate offices in Kansas City, Missouri, U.S.A at (+1) (816)221-1024.

[Message part 2 (text/html, inline)]

Message #14 received at 1001864-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 1001864-submitter@bugs.debian.org

Subject: closing 1001864

Date: Sat, 18 Dec 2021 09:52:39 +0100

close 1001864 2.4.1-1
thanks

Send a report that this bug log contains spam.