Security update for expat SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:14884-1 Final 1 1 2022-02-09T14:51:23Z current 2022-02-09T14:51:23Z 2022-02-09T14:51:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for expat This update for expat fixes the following issues: - CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054). - CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleposp3-expat-14884,slessp4-expat-14884 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-202214884-1/ Link for SUSE-SU-2022:14884-1 https://lists.suse.com/pipermail/sle-security-updates/2022-February/010199.html E-Mail link for SUSE-SU-2022:14884-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1195054 SUSE Bug 1195054 https://bugzilla.suse.com/1195217 SUSE Bug 1195217 https://www.suse.com/security/cve/CVE-2022-23852/ SUSE CVE CVE-2022-23852 page https://www.suse.com/security/cve/CVE-2022-23990/ SUSE CVE CVE-2022-23990 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP4-LTSS expat-2.0.1-88.42.15.1 libexpat1-2.0.1-88.42.15.1 libexpat1-32bit-2.0.1-88.42.15.1 expat-2.0.1-88.42.15.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 libexpat1-2.0.1-88.42.15.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 expat-2.0.1-88.42.15.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libexpat1-2.0.1-88.42.15.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libexpat1-32bit-2.0.1-88.42.15.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. CVE-2022-23852 SUSE Linux Enterprise Point of Sale 11 SP3:expat-2.0.1-88.42.15.1 SUSE Linux Enterprise Point of Sale 11 SP3:libexpat1-2.0.1-88.42.15.1 SUSE Linux Enterprise Server 11 SP4-LTSS:expat-2.0.1-88.42.15.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libexpat1-2.0.1-88.42.15.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libexpat1-32bit-2.0.1-88.42.15.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-202214884-1/ https://www.suse.com/security/cve/CVE-2022-23852.html CVE-2022-23852 https://bugzilla.suse.com/1195054 SUSE Bug 1195054 https://bugzilla.suse.com/1196480 SUSE Bug 1196480 https://bugzilla.suse.com/1200038 SUSE Bug 1200038 https://bugzilla.suse.com/1200198 SUSE Bug 1200198 Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. CVE-2022-23990 SUSE Linux Enterprise Point of Sale 11 SP3:expat-2.0.1-88.42.15.1 SUSE Linux Enterprise Point of Sale 11 SP3:libexpat1-2.0.1-88.42.15.1 SUSE Linux Enterprise Server 11 SP4-LTSS:expat-2.0.1-88.42.15.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libexpat1-2.0.1-88.42.15.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libexpat1-32bit-2.0.1-88.42.15.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-202214884-1/ https://www.suse.com/security/cve/CVE-2022-23990.html CVE-2022-23990 https://bugzilla.suse.com/1195217 SUSE Bug 1195217 https://bugzilla.suse.com/1196480 SUSE Bug 1196480 https://bugzilla.suse.com/1200038 SUSE Bug 1200038 https://bugzilla.suse.com/1200198 SUSE Bug 1200198