Your submission was sent successfully! Close

CVE-2021-46143

Published: 6 January 2022

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

Priority

Medium

CVSS 3 base score: 7.8

Status

Package Release Status
apache2
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code-not-compiled)
focal Not vulnerable
(code-not-compiled)
hirsute Not vulnerable
(code-not-compiled)
impish Not vulnerable
(code-not-compiled)
jammy Not vulnerable
(code-not-compiled)
trusty Not vulnerable
(code-not-compiled)
upstream Needs triage

xenial Not vulnerable
(code-not-compiled)
apr-util
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code-not-compiled)
focal Not vulnerable
(code-not-compiled)
hirsute Not vulnerable
(code-not-compiled)
impish Not vulnerable
(code-not-compiled)
jammy Not vulnerable
(code-not-compiled)
trusty Not vulnerable
(code-not-compiled)
upstream Needs triage

xenial Not vulnerable
(code-not-compiled)
astropy
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
audacity
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
ayttm
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
cableswig
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
cadaver
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
cmake
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code-not-compiled)
focal Not vulnerable
(code-not-compiled)
hirsute Not vulnerable
(code-not-compiled)
impish Not vulnerable
(code-not-compiled)
jammy Not vulnerable
(code-not-compiled)
trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(code-not-compiled)
coda
Launchpad, Ubuntu, Debian
focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
coin3
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Not vulnerable
(uses system expat)
hirsute Not vulnerable
(uses system expat)
impish Not vulnerable
(uses system expat)
jammy Not vulnerable
(uses system expat)
trusty Needs triage

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
emboss
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
expat
Launchpad, Ubuntu, Debian
bionic
Released (2.2.5-3ubuntu0.4)
focal
Released (2.2.9-1ubuntu0.2)
hirsute Ignored
(reached end-of-life)
impish
Released (2.4.1-2ubuntu0.1)
jammy
Released (2.4.3-1)
trusty
Released (2.1.0-4ubuntu1.4+esm4)
upstream Needs triage

xenial
Released (2.1.0-7ubuntu0.16.04.5+esm2)
firefox
Launchpad, Ubuntu, Debian
bionic
Released (98.0+build3-0ubuntu0.18.04.2)
focal
Released (98.0+build3-0ubuntu0.20.04.2)
impish
Released (98.0+build3-0ubuntu0.21.10.2)
jammy
Released (1:1snap1-0ubuntu1)
trusty Does not exist

upstream
Released (98)
xenial Needs triage

gdcm
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(uses system expat)
focal Not vulnerable
(uses system expat)
hirsute Not vulnerable
(uses system expat)
impish Not vulnerable
(uses system expat)
jammy Not vulnerable
(uses system expat)
trusty Not vulnerable
(uses system expat)
upstream Needs triage

xenial Not vulnerable
(uses system expat)
ghostscript
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code-not-compiled)
focal Not vulnerable
(code-not-compiled)
hirsute Not vulnerable
(code-not-compiled)
impish Not vulnerable
(code-not-compiled)
jammy Not vulnerable
(code-not-compiled)
trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(code-not-compiled)
harp
Launchpad, Ubuntu, Debian
focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
ibm-3270
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
insighttoolkit
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
insighttoolkit4
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
insighttoolkit5
Launchpad, Ubuntu, Debian
jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
libsynthesis
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
libxmltok
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
mame
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
matanza
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
opencollada
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
paraview
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
poco
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Needs triage

upstream Needs triage

xenial Ignored
(out of standard support)
python2.7
Launchpad, Ubuntu, Debian
bionic Not vulnerable

focal Not vulnerable

hirsute Ignored
(reached end-of-life)
impish Not vulnerable

jammy Not vulnerable

trusty Not vulnerable

upstream Not vulnerable

xenial Not vulnerable

python3.10
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

hirsute Ignored
(reached end-of-life)
impish Not vulnerable

jammy Not vulnerable

trusty Does not exist

upstream Not vulnerable

xenial Does not exist

python3.4
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

trusty Not vulnerable

upstream Not vulnerable

xenial Does not exist

python3.5
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

trusty Not vulnerable

upstream Not vulnerable

xenial Not vulnerable

python3.6
Launchpad, Ubuntu, Debian
bionic Not vulnerable

focal Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

trusty Does not exist

upstream Not vulnerable

xenial Does not exist

python3.7
Launchpad, Ubuntu, Debian
bionic Not vulnerable

focal Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

trusty Does not exist

upstream Not vulnerable

xenial Does not exist

python3.8
Launchpad, Ubuntu, Debian
bionic Not vulnerable

focal Not vulnerable

hirsute Does not exist

impish Does not exist

jammy Does not exist

trusty Does not exist

upstream Not vulnerable

xenial Does not exist

python3.9
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Not vulnerable

hirsute Ignored
(reached end-of-life)
impish Not vulnerable

jammy Does not exist

trusty Does not exist

upstream Not vulnerable

xenial Does not exist

qtwebengine-opensource-src
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
sitecopy
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
smart
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code-not-compiled)
focal Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(code-not-compiled)
swish-e
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
tdom
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
texlive-bin
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code-not-compiled)
focal Not vulnerable
(code-not-compiled)
hirsute Not vulnerable
(code-not-compiled)
impish Not vulnerable
(code-not-compiled)
jammy Not vulnerable
(code-not-compiled)
trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(code-not-compiled)
thunderbird
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Does not exist

upstream Needs triage

xenial Needs triage

tla
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
visp
Launchpad, Ubuntu, Debian
bionic Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
vnc4
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

trusty Needs triage

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
vtk
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
wbxml2
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
xmlrpc
Launchpad, Ubuntu, Debian
trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)
xmlrpc-c
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Needs triage

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
xsd
Launchpad, Ubuntu, Debian
bionic Needs triage

focal Needs triage

hirsute Ignored
(reached end-of-life)
impish Needs triage

jammy Needs triage

trusty Ignored
(out of standard support)
upstream Needs triage

xenial Ignored
(out of standard support)

Notes

AuthorNote
sbeattie
paraview uses system expat
xotcl uses system expat
poco uses system expat
gdcm uses system expat
audacity uses system expat
simgear uses system expat
coin3 uses system expat as of 4.0.0~CMake~6f54f1602475+ds1-1
sitecopy uses system expat since 1:0.16.0-1 (dapper!)
leosilva
python uses system expat

References

Bugs