The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of servic...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Debian:12 expat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-2"}]}]

Debian:13 expat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-2"}]}]

Debian:14 expat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-2"}]}]

Debian:12 libxmltok

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

参照URL

advisory security-tracker.debian.org