USN-5638-2: Expat vulnerabilities

Releases

• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• expat - XML parsing C library

Details

USN-5638-1 fixed a vulnerability in Expat. This update provides
the corresponding updates for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS.

It was discovered that Expat incorrectly handled memory in out-of-memory
situations. An attacker could possibly use this issue to cause a crash,
resulting in a denial of service, or possibly execute arbitrary code.
This issue only affected Ubuntu 18.04 LTS. (CVE-2022-43680)

Original advisory details:

Rhodri James discovered that Expat incorrectly handled memory when
processing certain malformed XML files. An attacker could possibly
use this issue to cause a crash or execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.04

• expat - 2.4.7-1ubuntu0.1
• libexpat1 - 2.4.7-1ubuntu0.1

Ubuntu 20.04

• expat - 2.2.9-1ubuntu0.5
• libexpat1 - 2.2.9-1ubuntu0.5

Ubuntu 18.04

• expat - 2.2.5-3ubuntu0.8
• libexpat1 - 2.2.5-3ubuntu0.8

In general, a standard system update will make all the necessary changes.

References

• CVE-2022-43680
• CVE-2022-40674

Related notices

• USN-5638-3
• USN-5638-4
• USN-5638-1
• USN-5726-1