Your submission was sent successfully! Close

CVE-2018-20843

Published: 24 June 2019

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).

Notes

AuthorNote
mdeslaur
xmlparse.c doesn't appear to be built in the firefox package
Priority

Low

CVSS 3 base score: 7.5

Status

Package Release Status
apache2
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code-not-compiled)
cosmic Not vulnerable
(code-not-compiled)
disco Not vulnerable
(code-not-compiled)
eoan Not vulnerable
(code-not-compiled)
focal Not vulnerable
(code-not-compiled)
groovy Not vulnerable
(code-not-compiled)
hirsute Not vulnerable
(code-not-compiled)
impish Not vulnerable
(code-not-compiled)
jammy Not vulnerable
(code-not-compiled)
precise Not vulnerable
(code-not-compiled)
trusty Not vulnerable
(code-not-compiled)
upstream Needs triage

xenial Not vulnerable
(code-not-compiled)
apr-util
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code-not-compiled)
cosmic Not vulnerable
(code-not-compiled)
disco Not vulnerable
(code-not-compiled)
eoan Not vulnerable
(code-not-compiled)
focal Not vulnerable
(code-not-compiled)
groovy Not vulnerable
(code-not-compiled)
hirsute Not vulnerable
(code-not-compiled)
impish Not vulnerable
(code-not-compiled)
jammy Not vulnerable
(code-not-compiled)
precise Not vulnerable
(code-not-compiled)
trusty Not vulnerable
(code-not-compiled)
upstream Needs triage

xenial Not vulnerable
(code-not-compiled)
audacity
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(uses system expat)
cosmic Not vulnerable
(uses system expat)
disco Not vulnerable
(uses system expat)
eoan Not vulnerable
(uses system expat)
focal Not vulnerable
(uses system expat)
groovy Not vulnerable
(uses system expat)
hirsute Not vulnerable
(uses system expat)
impish Not vulnerable
(uses system expat)
jammy Not vulnerable
(uses system expat)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(uses system expat)
ayttm
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
cableswig
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
cadaver
Launchpad, Ubuntu, Debian
bionic Needs triage

cosmic Ignored
(reached end-of-life)
disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy Needs triage

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
cmake
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code-not-compiled)
cosmic Not vulnerable
(code-not-compiled)
disco Not vulnerable
(code-not-compiled)
eoan Not vulnerable
(code-not-compiled)
focal Not vulnerable
(code-not-compiled)
groovy Not vulnerable
(code-not-compiled)
hirsute Not vulnerable
(code-not-compiled)
impish Not vulnerable
(code-not-compiled)
jammy Not vulnerable
(code-not-compiled)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(code-not-compiled)
coin3
Launchpad, Ubuntu, Debian
bionic Needed

cosmic Ignored
(reached end-of-life)
disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Not vulnerable
(uses system expat)
groovy Ignored
(reached end-of-life)
hirsute Not vulnerable
(uses system expat)
impish Not vulnerable
(uses system expat)
jammy Not vulnerable
(uses system expat)
precise Does not exist

trusty Needed

upstream Needs triage

xenial Ignored
(end of standard support, was needed)
expat
Launchpad, Ubuntu, Debian
bionic
Released (2.2.5-3ubuntu0.1)
cosmic
Released (2.2.6-1ubuntu0.18.10)
disco
Released (2.2.6-1ubuntu0.19.04)
eoan
Released (2.2.6-2)
focal
Released (2.2.6-2)
groovy
Released (2.2.6-2)
hirsute
Released (2.2.6-2)
impish
Released (2.2.6-2)
jammy
Released (2.2.6-2)
precise
Released (2.0.1-7.2ubuntu1.6)
trusty
Released (2.1.0-4ubuntu1.4+esm1)
upstream
Released (2.2.6-2)
xenial
Released (2.1.0-7ubuntu0.16.04.4)
Patches:
upstream: https://github.com/libexpat/libexpat/commit/11f8838bf99ea0a6f0b76f9760c43704d00c4ff6
firefox
Launchpad, Ubuntu, Debian
bionic Not vulnerable

cosmic Ignored
(reached end-of-life)
disco Ignored
(reached end-of-life)
eoan Not vulnerable

focal Not vulnerable

groovy Not vulnerable

hirsute Not vulnerable

impish Not vulnerable

jammy Not vulnerable

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable

gdcm
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(uses system expat)
cosmic Not vulnerable
(uses system expat)
disco Not vulnerable
(uses system expat)
eoan Not vulnerable
(uses system expat)
focal Not vulnerable
(uses system expat)
groovy Not vulnerable
(uses system expat)
hirsute Not vulnerable
(uses system expat)
impish Not vulnerable
(uses system expat)
jammy Not vulnerable
(uses system expat)
precise Does not exist

trusty Not vulnerable
(uses system expat)
upstream Needs triage

xenial Not vulnerable
(uses system expat)
ghostscript
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code-not-compiled)
cosmic Not vulnerable
(code-not-compiled)
disco Not vulnerable
(code-not-compiled)
eoan Not vulnerable
(code-not-compiled)
focal Not vulnerable
(code-not-compiled)
groovy Not vulnerable
(code-not-compiled)
hirsute Not vulnerable
(code-not-compiled)
impish Not vulnerable
(code-not-compiled)
jammy Not vulnerable
(code-not-compiled)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(code-not-compiled)
insighttoolkit
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
insighttoolkit4
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(uses system expat)
cosmic Not vulnerable
(uses system expat)
disco Not vulnerable
(uses system expat)
eoan Not vulnerable
(uses system expat)
focal Not vulnerable
(uses system expat)
groovy Not vulnerable
(uses system expat)
hirsute Not vulnerable
(uses system expat)
impish Not vulnerable
(uses system expat)
jammy Not vulnerable
(uses system expat)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needed)
kompozer
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

libparagui1.1
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

libxmltok
Launchpad, Ubuntu, Debian
bionic Needed

focal Needed

hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy Needed

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
matanza
Launchpad, Ubuntu, Debian
bionic Needs triage

cosmic Ignored
(reached end-of-life)
disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy Needs triage

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
poco
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(uses system expat)
cosmic Not vulnerable
(uses system expat)
disco Not vulnerable
(uses system expat)
eoan Not vulnerable
(uses system expat)
focal Not vulnerable
(uses system expat)
groovy Not vulnerable
(uses system expat)
hirsute Not vulnerable
(uses system expat)
impish Not vulnerable
(uses system expat)
jammy Not vulnerable
(uses system expat)
precise Does not exist

trusty Not vulnerable
(uses system expat)
upstream Needs triage

xenial Not vulnerable
(uses system expat)
simgear
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(uses system expat)
cosmic Not vulnerable
(uses system expat)
disco Not vulnerable
(uses system expat)
eoan Not vulnerable
(uses system expat)
focal Not vulnerable
(uses system expat)
groovy Not vulnerable
(uses system expat)
hirsute Not vulnerable
(uses system expat)
impish Not vulnerable
(uses system expat)
jammy Not vulnerable
(uses system expat)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(uses system expat)
sitecopy
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(uses system expat)
cosmic Not vulnerable
(uses system expat)
disco Not vulnerable
(uses system expat)
eoan Not vulnerable
(uses system expat)
focal Not vulnerable
(uses system expat)
groovy Not vulnerable
(uses system expat)
hirsute Not vulnerable
(uses system expat)
impish Not vulnerable
(uses system expat)
jammy Not vulnerable
(uses system expat)
precise Does not exist

trusty Does not exist

upstream Not vulnerable
(uses system expat)
xenial Not vulnerable
(uses system expat)
smart
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code-not-compiled)
cosmic Not vulnerable
(code-not-compiled)
disco Not vulnerable
(code-not-compiled)
eoan Not vulnerable
(code-not-compiled)
focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(code-not-compiled)
swish-e
Launchpad, Ubuntu, Debian
bionic Needs triage

cosmic Ignored
(reached end-of-life)
disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy Needs triage

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
tdom
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(uses system expat)
cosmic Ignored
(reached end-of-life)
disco Not vulnerable
(uses system expat)
eoan Not vulnerable
(uses system expat)
focal Not vulnerable
(uses system expat)
groovy Not vulnerable
(uses system expat)
hirsute Not vulnerable
(uses system expat)
impish Not vulnerable
(uses system expat)
jammy Not vulnerable
(uses system expat)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(uses system expat)
texlive-bin
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code-not-compiled)
cosmic Not vulnerable
(code-not-compiled)
disco Not vulnerable
(code-not-compiled)
eoan Not vulnerable
(code-not-compiled)
focal Not vulnerable
(code-not-compiled)
groovy Not vulnerable
(code-not-compiled)
hirsute Not vulnerable
(code-not-compiled)
impish Not vulnerable
(code-not-compiled)
jammy Not vulnerable
(code-not-compiled)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(code-not-compiled)
thunderbird
Launchpad, Ubuntu, Debian
bionic Not vulnerable

cosmic Ignored
(reached end-of-life)
disco Ignored
(reached end-of-life)
eoan Not vulnerable

focal Not vulnerable

groovy Not vulnerable

hirsute Not vulnerable

impish Not vulnerable

jammy Not vulnerable

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable

vnc4
Launchpad, Ubuntu, Debian
bionic Needed

cosmic Ignored
(reached end-of-life)
disco Not vulnerable
(code not present)
eoan Not vulnerable
(code not present)
focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

precise Does not exist

trusty Needed

upstream Needed

xenial Ignored
(end of standard support, was needed)
vtk
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needed)
wbxml2
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(uses system expat)
cosmic Not vulnerable
(uses system expat)
disco Not vulnerable
(uses system expat)
eoan Not vulnerable
(uses system expat)
focal Not vulnerable
(uses system expat)
groovy Not vulnerable
(uses system expat)
hirsute Not vulnerable
(uses system expat)
impish Not vulnerable
(uses system expat)
jammy Not vulnerable
(uses system expat)
precise Does not exist

trusty Does not exist

upstream Not vulnerable
(uses system expat)
xenial Not vulnerable
(uses system expat)
wxwidgets2.6
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

wxwidgets2.8
Launchpad, Ubuntu, Debian
bionic Does not exist

cosmic Does not exist

disco Does not exist

eoan Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

xmlrpc-c
Launchpad, Ubuntu, Debian
bionic Needs triage

cosmic Ignored
(reached end-of-life)
disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy Needs triage

precise Does not exist

trusty Needs triage

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)