Multiple invalid left shifts in libexpat
Categories
(Core :: XML, defect)
Tracking
()
People
(Reporter: tsmith, Unassigned)
References
(Blocks 1 open bug, )
Details
(Keywords: csectype-undefined, sec-low)
Attachments
(1 file, 2 obsolete files)
|
(deleted),
text/plain
|
Details |
|
Reporter | |
Comment 1•9 years ago
|
||
|
|
Reporter | |
Comment 2•9 years ago
|
||
|
|
Reporter | |
Updated•7 years ago
|
|
||
Comment 3•5 years ago
|
||
Can you file a bug in the Expat tracker (https://github.com/libexpat/libexpat) for the patch in xmlparse.c? The problems addressed in the patch for xmltok.c have been fixed in https://sourceforge.net/p/expat/bugs/529/.
|
|
||
Updated•5 years ago
|
|
|
Reporter | |
Comment 4•3 years ago
|
||
Fixes are available. Upstream issue: https://github.com/libexpat/libexpat/issues/531
Commit 2106ee4 addresses the issues in xmlparse.c
|
|
Reporter | |
Updated•3 years ago
|
|
|
Reporter | |
Updated•3 years ago
|
|
|
Reporter | |
Updated•3 years ago
|
Tyson, FYI I have just requested a CVE for the 2 unfixed cases from Mitre.
|
|
Reporter | |
Comment 6•3 years ago
|
||
Note: Bug 1688452 sandboxes Expat via RLBox
|
||
Comment 7•3 years ago
|
||
Doesn't sound easy to exploit, so I'll mark it sec-low. Only 91 is really affected from a sec perspective due to RLBox, but we should fix it on Nightly at least.
|
||
Comment 8•3 years ago
|
||
Does it make more sense to move status-firefox97 to disabled due to RLBox, too?
|
|
||
Comment 9•3 years ago
|
||
I think I meant to mark it wontfix, not disabled.
|
||
Comment 10•3 years ago
|
||
Glad we have rlbox \o/
FWIW, it has been uploaded in Debian old old stable:
https://tracker.debian.org/news/1299039/accepted-expat-220-2deb9u4-source-into-oldoldstable/
|
||
Updated•3 years ago
|
|
|
||
Updated•3 years ago
|
|
|
||
Comment 11•3 years ago
|
||
The xmltok.c issue was fixed a while ago in bug 1374012.
The xmlparse.c issue is CVE-2021-45960 and was fixed in bug 1754724.
|
|
||
Updated•3 years ago
|
|
||
Updated•2 years ago
|
Description
•