Debian update for expat
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2016-9063 CVE-2017-9233 |
| CWE-ID | CWE-190 CWE-611 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Debian Linux Operating systems & Components / Operating system |
| Vendor | Debian |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Integer overflow
EUVDB-ID: #VU7241
Risk: Low
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2016-9063
CWE-ID:
CWE-190 - Integer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to an integer overflow when handling malicious XML files. A remote attacker can send manipulated XML content, trick the victim into opening it and cause the application using the Expat library to crash.
Successful exploitation of the vulnerability results in denial of service.
Update the affected package to version: 2.1.0-6+deb8u4, 2.2.0-2+deb9u1, 2.2.1-1, 2.2.1-1
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttps://www.debian.org/security/2017/dsa-3898
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Improper Restriction of XML External Entity Reference
EUVDB-ID: #VU7242
Risk: Low
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2017-9233
CWE-ID:
CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an error within entityValueInitProcessor() function while parsing malformed XML in an external entity. An attacker can take advantage of this flaw to cause a denial of service against an application using the Expat library.
Successful exploitation of the vulnerability may allow an attacker to perform a denial of service attack.
Update the affected package to version: 2.1.0-6+deb8u4, 2.2.0-2+deb9u1, 2.2.1-1, 2.2.1-1
Vulnerable software versionsDebian Linux: All versions
CPE2.3 External linkshttps://www.debian.org/security/2017/dsa-3898
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
