Описание
Security update for expat
This update for expat fixes the following issues:
- CVE-2021-45960: Fixed left shift in the storeAtts function in xmlparse.c that can lead to realloc misbehavior (bsc#1194251).
- CVE-2021-46143: Fixed integer overflow in m_groupSize in doProlog (bsc#1194362).
- CVE-2022-22822: Fixed integer overflow in addBinding in xmlparse.c (bsc#1194474).
- CVE-2022-22823: Fixed integer overflow in build_model in xmlparse.c (bsc#1194476).
- CVE-2022-22824: Fixed integer overflow in defineAttribute in xmlparse.c (bsc#1194477).
- CVE-2022-22825: Fixed integer overflow in lookup in xmlparse.c (bsc#1194478).
- CVE-2022-22826: Fixed integer overflow in nextScaffoldPart in xmlparse.c (bsc#1194479).
- CVE-2022-22827: Fixed integer overflow in storeAtts in xmlparse.c (bsc#1194480).
Список пакетов
Container bci/bci-init:15.3
Container bci/golang:1.16
Container bci/golang:1.17
Container bci/golang:latest
Container bci/node:12
Container bci/node:14
Container bci/nodejs:latest
Container bci/openjdk-devel:11
Container bci/openjdk:latest
Container bci/python:3
Container bci/ruby:latest
Container caasp/v4/389-ds:1.4.2
Container caasp/v4/cilium:1.6.6
Container caasp/v4/etcd:3.4.13
Container caasp/v4/hyperkube:v1.17.17
Container caasp/v4/k8s-sidecar:0.1.75
Container caasp/v4/prometheus-alertmanager:0.16.2
Container caasp/v4/prometheus-pushgateway:0.6.0
Container caasp/v4/prometheus-server:2.7.1
Container caasp/v4/rsyslog:8.39.0
Container caasp/v4/skuba-tooling:0.1.0
Container ses/6/cephcsi/cephcsi:latest
Container ses/6/rook/ceph:latest
Container ses/7.1/ceph/haproxy:latest
Container ses/7.1/ceph/keepalived:latest
Container ses/7.1/cephcsi/cephcsi:latest
Container ses/7.1/rook/ceph:latest
Container ses/7/cephcsi/cephcsi:latest
Container ses/7/prometheus-webhook-snmp:latest
Container ses/7/rook/ceph:latest
Container suse/pcp:latest
Container suse/rmt-mariadb:latest
Container suse/rmt-nginx:latest
Container suse/sle-micro-rancher/5.2:latest
Container suse/sle-micro/5.1/toolbox:latest
Container suse/sle-micro/5.2/toolbox:latest
Container trento/trento-db:latest
Container trento/trento-runner:latest
Image SLES15-Azure-BYOS
Image SLES15-EC2-CHOST-HVM-BYOS
Image SLES15-EC2-HVM-BYOS
Image SLES15-GCE-BYOS
Image SLES15-SAP-Azure
Image SLES15-SAP-Azure-BYOS
Image SLES15-SAP-Azure-LI-BYOS-Production
Image SLES15-SAP-Azure-VLI-BYOS-Production
Image SLES15-SAP-EC2-HVM
Image SLES15-SAP-EC2-HVM-BYOS
Image SLES15-SAP-GCE
Image SLES15-SAP-GCE-BYOS
Image SLES15-SP1-Azure-BYOS
Image SLES15-SP1-Azure-HPC-BYOS
Image SLES15-SP1-CHOST-BYOS-Azure
Image SLES15-SP1-CHOST-BYOS-EC2
Image SLES15-SP1-CHOST-BYOS-GCE
Image SLES15-SP1-EC2-HPC-HVM-BYOS
Image SLES15-SP1-EC2-HVM-BYOS
Image SLES15-SP1-GCE-BYOS
Image SLES15-SP1-SAP-Azure
Image SLES15-SP1-SAP-Azure-BYOS
Image SLES15-SP1-SAP-Azure-LI-BYOS-Production
Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP1-SAP-EC2-HVM
Image SLES15-SP1-SAP-EC2-HVM-BYOS
Image SLES15-SP1-SAP-GCE
Image SLES15-SP1-SAP-GCE-BYOS
Image SLES15-SP1-SAPCAL-Azure
Image SLES15-SP1-SAPCAL-EC2-HVM
Image SLES15-SP1-SAPCAL-GCE
Image SLES15-SP2-BYOS-Azure
Image SLES15-SP2-BYOS-EC2-HVM
Image SLES15-SP2-BYOS-GCE
Image SLES15-SP2-CHOST-BYOS-Aliyun
Image SLES15-SP2-CHOST-BYOS-Azure
Image SLES15-SP2-CHOST-BYOS-EC2
Image SLES15-SP2-CHOST-BYOS-GCE
Image SLES15-SP2-HPC-BYOS-Azure
Image SLES15-SP2-HPC-BYOS-EC2-HVM
Image SLES15-SP2-Manager-4-1-Proxy-BYOS-Azure
Image SLES15-SP2-Manager-4-1-Proxy-BYOS-EC2-HVM
Image SLES15-SP2-Manager-4-1-Proxy-BYOS-GCE
Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure
Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM
Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE
Image SLES15-SP2-SAP-Azure
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production
Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP2-SAP-BYOS-Azure
Image SLES15-SP2-SAP-BYOS-EC2-HVM
Image SLES15-SP2-SAP-BYOS-GCE
Image SLES15-SP2-SAP-EC2-HVM
Image SLES15-SP2-SAP-GCE
Image SLES15-SP3-BYOS-Azure
Image SLES15-SP3-BYOS-EC2-HVM
Image SLES15-SP3-BYOS-GCE
Image SLES15-SP3-CHOST-BYOS-Aliyun
Image SLES15-SP3-CHOST-BYOS-Azure
Image SLES15-SP3-CHOST-BYOS-EC2
Image SLES15-SP3-CHOST-BYOS-GCE
Image SLES15-SP3-CHOST-BYOS-SAP-CCloud
Image SLES15-SP3-EC2-ECS-HVM
Image SLES15-SP3-EC2-HVM
Image SLES15-SP3-GCE
Image SLES15-SP3-HPC-Azure
Image SLES15-SP3-HPC-BYOS-Azure
Image SLES15-SP3-HPC-BYOS-EC2-HVM
Image SLES15-SP3-HPC-BYOS-GCE
Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure
Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM
Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE
Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure
Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM
Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE
Image SLES15-SP3-Micro-5-1-BYOS-Azure
Image SLES15-SP3-Micro-5-1-BYOS-EC2-HVM
Image SLES15-SP3-Micro-5-1-BYOS-GCE
Image SLES15-SP3-Micro-5-2-BYOS-Azure
Image SLES15-SP3-Micro-5-2-BYOS-EC2-HVM
Image SLES15-SP3-Micro-5-2-BYOS-GCE
Image SLES15-SP3-Micro-BYOS-GCE
Image SLES15-SP3-SAP-Azure
Image SLES15-SP3-SAP-Azure-LI-BYOS-Production
Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production
Image SLES15-SP3-SAP-BYOS-Azure
Image SLES15-SP3-SAP-BYOS-EC2-HVM
Image SLES15-SP3-SAP-BYOS-GCE
Image SLES15-SP3-SAP-EC2-HVM
Image SLES15-SP3-SAP-GCE
Image SLES15-SP3-SAPCAL-Azure
Image SLES15-SP3-SAPCAL-EC2-HVM
Image SLES15-SP3-SAPCAL-GCE
SUSE Enterprise Storage 6
SUSE Enterprise Storage 7
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS
SUSE Linux Enterprise High Performance Computing 15-ESPOS
SUSE Linux Enterprise High Performance Computing 15-LTSS
SUSE Linux Enterprise Micro 5.0
SUSE Linux Enterprise Micro 5.1
SUSE Linux Enterprise Module for Basesystem 15 SP3
SUSE Linux Enterprise Server 15 SP1-BCL
SUSE Linux Enterprise Server 15 SP1-LTSS
SUSE Linux Enterprise Server 15 SP2-BCL
SUSE Linux Enterprise Server 15 SP2-LTSS
SUSE Linux Enterprise Server 15-LTSS
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server for SAP Applications 15 SP1
SUSE Linux Enterprise Server for SAP Applications 15 SP2
SUSE Manager Proxy 4.1
SUSE Manager Retail Branch Server 4.1
SUSE Manager Server 4.1
Ссылки
- Link for SUSE-SU-2022:0178-1
- E-Mail link for SUSE-SU-2022:0178-1
- SUSE Security Ratings
- SUSE Bug 1194251
- SUSE Bug 1194362
- SUSE Bug 1194474
- SUSE Bug 1194476
- SUSE Bug 1194477
- SUSE Bug 1194478
- SUSE Bug 1194479
- SUSE Bug 1194480
- SUSE CVE CVE-2021-45960 page
- SUSE CVE CVE-2021-46143 page
- SUSE CVE CVE-2022-22822 page
- SUSE CVE CVE-2022-22823 page
- SUSE CVE CVE-2022-22824 page
- SUSE CVE CVE-2022-22825 page
- SUSE CVE CVE-2022-22826 page
- SUSE CVE CVE-2022-22827 page
Описание
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
Затронутые продукты
Ссылки
- CVE-2021-45960
- SUSE Bug 1194251
Описание
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
Затронутые продукты
Ссылки
- CVE-2021-46143
- SUSE Bug 1194362
- SUSE Bug 1195327
- SUSE Bug 1196387
- SUSE Bug 1200038
- SUSE Bug 1200198
Описание
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Затронутые продукты
Ссылки
- CVE-2022-22822
- SUSE Bug 1194474
- SUSE Bug 1195327
- SUSE Bug 1200038
- SUSE Bug 1200198
Описание
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Затронутые продукты
Ссылки
- CVE-2022-22823
- SUSE Bug 1194476
- SUSE Bug 1195327
- SUSE Bug 1200038
- SUSE Bug 1200198
Описание
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Затронутые продукты
Ссылки
- CVE-2022-22824
- SUSE Bug 1194477
- SUSE Bug 1195327
- SUSE Bug 1200038
- SUSE Bug 1200198
Описание
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Затронутые продукты
Ссылки
- CVE-2022-22825
- SUSE Bug 1194478
- SUSE Bug 1195327
- SUSE Bug 1200038
- SUSE Bug 1200198
Описание
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Затронутые продукты
Ссылки
- CVE-2022-22826
- SUSE Bug 1194479
- SUSE Bug 1195327
- SUSE Bug 1200038
- SUSE Bug 1200198
Описание
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
Затронутые продукты
Ссылки
- CVE-2022-22827
- SUSE Bug 1194480
- SUSE Bug 1195327
- SUSE Bug 1200038
- SUSE Bug 1200198