Lucene search

PRIOn knowledge basePRION:CVE-2019-15903

HistorySep 04, 2019 - 6:15 a.m.

Heap overflow

2019-09-0406:15:00

PRIOn knowledge base

www.prio-n.com

8 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.5%

JSON

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

CPENameOperatorVersion
libexpatlt2.2.8
pythonge3.5.0
pythonlt3.5.8
pythonge2.7.0
pythonlt2.7.17
pythonge3.7.0
pythonlt3.7.5
pythonge3.6.0
pythonlt3.6.10

Name	Operator	Version
libexpat	lt	2.2.8
python	ge	3.5.0
python	lt	3.5.8
python	ge	2.7.0
python	lt	2.7.17
python	ge	3.7.0
python	lt	3.7.5
python	ge	3.6.0
python	lt	3.6.10

References

lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html

lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html

lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html

lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html

lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html

lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html

lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html

lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html

lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html

lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html

lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html

lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html

packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html

packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html

seclists.org/fulldisclosure/2019/Dec/23

seclists.org/fulldisclosure/2019/Dec/26

seclists.org/fulldisclosure/2019/Dec/27

seclists.org/fulldisclosure/2019/Dec/30

access.redhat.com/errata/RHSA-2019:3210

access.redhat.com/errata/RHSA-2019:3237

access.redhat.com/errata/RHSA-2019:3756

github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43

github.com/libexpat/libexpat/issues/317

github.com/libexpat/libexpat/issues/342

github.com/libexpat/libexpat/pull/318

lists.debian.org/debian-lts-announce/2019/11/msg00006.html

lists.debian.org/debian-lts-announce/2019/11/msg00017.html

lists.fedoraproject.org/archives/list/[email protected]/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/

lists.fedoraproject.org/archives/list/[email protected]/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/

lists.fedoraproject.org/archives/list/[email protected]/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/

seclists.org/bugtraq/2019/Dec/17

seclists.org/bugtraq/2019/Dec/21

seclists.org/bugtraq/2019/Dec/23

seclists.org/bugtraq/2019/Nov/1

seclists.org/bugtraq/2019/Nov/24

seclists.org/bugtraq/2019/Oct/29

seclists.org/bugtraq/2019/Sep/30

seclists.org/bugtraq/2019/Sep/37

security.gentoo.org/glsa/201911-08

security.netapp.com/advisory/ntap-20190926-0004/

support.apple.com/kb/HT210785

support.apple.com/kb/HT210788

support.apple.com/kb/HT210789

support.apple.com/kb/HT210790

support.apple.com/kb/HT210793

support.apple.com/kb/HT210794

support.apple.com/kb/HT210795

usn.ubuntu.com/4132-1/

usn.ubuntu.com/4132-2/

usn.ubuntu.com/4165-1/

usn.ubuntu.com/4202-1/

usn.ubuntu.com/4335-1/

www.debian.org/security/2019/dsa-4530

www.debian.org/security/2019/dsa-4549

www.debian.org/security/2019/dsa-4571

www.oracle.com/security-alerts/cpuapr2020.html

www.oracle.com/security-alerts/cpuoct2020.html

www.tenable.com/security/tns-2021-11