This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-45960 →

DEBIAN-CVE-2021-45960

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g...

Original description

The description as published by the source.

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 expat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1"}]}]

Debian:13 expat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1"}]}]

Debian:14 expat

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1"}]}]

Debian:12 libxmltok

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org