Version in base suite: 2.5.0-1 Base version: expat_2.5.0-1 Target version: expat_2.5.0-1+deb12u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/e/expat/expat_2.5.0-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/e/expat/expat_2.5.0-1+deb12u1.dsc changelog | 11 +++++++++++ patches/CVE-2024-45490.patch | 28 ++++++++++++++++++++++++++++ patches/CVE-2024-45491.patch | 31 +++++++++++++++++++++++++++++++ patches/CVE-2024-45492.patch | 30 ++++++++++++++++++++++++++++++ patches/series | 3 +++ 5 files changed, 103 insertions(+) diff -Nru expat-2.5.0/debian/changelog expat-2.5.0/debian/changelog --- expat-2.5.0/debian/changelog 2022-10-26 13:31:29.000000000 +0000 +++ expat-2.5.0/debian/changelog 2024-09-08 06:44:19.000000000 +0000 @@ -1,3 +1,14 @@ +expat (2.5.0-1+deb12u1) bookworm-security; urgency=medium + + * Backport security fix for CVE-2024-45490: reject negative len for + XML_ParseBuffer() (closes: #1080149). + * Backport security fix for CVE-2024-45491: detect integer overflow in + dtdCopy() (closes: #1080150). + * Backport security fix for CVE-2024-45492: detect integer overflow in + function nextScaffoldPart() (closes: #1080152). + + -- Laszlo Boszormenyi (GCS) Sun, 08 Sep 2024 08:44:19 +0200 + expat (2.5.0-1) unstable; urgency=high * New upstream release: diff -Nru expat-2.5.0/debian/patches/CVE-2024-45490.patch expat-2.5.0/debian/patches/CVE-2024-45490.patch --- expat-2.5.0/debian/patches/CVE-2024-45490.patch 1970-01-01 00:00:00.000000000 +0000 +++ expat-2.5.0/debian/patches/CVE-2024-45490.patch 2024-09-08 06:44:09.000000000 +0000 @@ -0,0 +1,28 @@ +From 5c1a31642e243f4870c0bd1f2afc7597976521bf Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Mon, 19 Aug 2024 22:26:07 +0200 +Subject: [PATCH 1/3] lib: Reject negative len for XML_ParseBuffer + +Reported by TaiYou +--- + expat/lib/xmlparse.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index 91682c188..ba1038119 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -1985,6 +1985,12 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) { + + if (parser == NULL) + return XML_STATUS_ERROR; ++ ++ if (len < 0) { ++ parser->m_errorCode = XML_ERROR_INVALID_ARGUMENT; ++ return XML_STATUS_ERROR; ++ } ++ + switch (parser->m_parsingStatus.parsing) { + case XML_SUSPENDED: + parser->m_errorCode = XML_ERROR_SUSPENDED; + diff -Nru expat-2.5.0/debian/patches/CVE-2024-45491.patch expat-2.5.0/debian/patches/CVE-2024-45491.patch --- expat-2.5.0/debian/patches/CVE-2024-45491.patch 1970-01-01 00:00:00.000000000 +0000 +++ expat-2.5.0/debian/patches/CVE-2024-45491.patch 2024-09-08 06:44:19.000000000 +0000 @@ -0,0 +1,31 @@ +From 8e439a9947e9dc80a395c0c7456545d8d9d9e421 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Mon, 19 Aug 2024 22:34:13 +0200 +Subject: [PATCH] lib: Detect integer overflow in dtdCopy + +Reported by TaiYou +--- + expat/lib/xmlparse.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index 91682c188..e2327bdcf 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -6890,6 +6890,16 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd, + if (! newE) + return 0; + if (oldE->nDefaultAtts) { ++ /* Detect and prevent integer overflow. ++ * The preprocessor guard addresses the "always false" warning ++ * from -Wtype-limits on platforms where ++ * sizeof(int) < sizeof(size_t), e.g. on x86_64. */ ++#if UINT_MAX >= SIZE_MAX ++ if ((size_t)oldE->nDefaultAtts ++ > ((size_t)(-1) / sizeof(DEFAULT_ATTRIBUTE))) { ++ return 0; ++ } ++#endif + newE->defaultAtts + = ms->malloc_fcn(oldE->nDefaultAtts * sizeof(DEFAULT_ATTRIBUTE)); + if (! newE->defaultAtts) { diff -Nru expat-2.5.0/debian/patches/CVE-2024-45492.patch expat-2.5.0/debian/patches/CVE-2024-45492.patch --- expat-2.5.0/debian/patches/CVE-2024-45492.patch 1970-01-01 00:00:00.000000000 +0000 +++ expat-2.5.0/debian/patches/CVE-2024-45492.patch 2024-09-08 06:44:19.000000000 +0000 @@ -0,0 +1,30 @@ +From 9bf0f2c16ee86f644dd1432507edff94c08dc232 Mon Sep 17 00:00:00 2001 +From: Sebastian Pipping +Date: Mon, 19 Aug 2024 22:37:16 +0200 +Subject: [PATCH] lib: Detect integer overflow in function nextScaffoldPart + +Reported by TaiYou +--- + expat/lib/xmlparse.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c +index 91682c188..f737575ea 100644 +--- a/expat/lib/xmlparse.c ++++ b/expat/lib/xmlparse.c +@@ -7442,6 +7442,15 @@ nextScaffoldPart(XML_Parser parser) { + int next; + + if (! dtd->scaffIndex) { ++ /* Detect and prevent integer overflow. ++ * The preprocessor guard addresses the "always false" warning ++ * from -Wtype-limits on platforms where ++ * sizeof(unsigned int) < sizeof(size_t), e.g. on x86_64. */ ++#if UINT_MAX >= SIZE_MAX ++ if (parser->m_groupSize > ((size_t)(-1) / sizeof(int))) { ++ return -1; ++ } ++#endif + dtd->scaffIndex = (int *)MALLOC(parser, parser->m_groupSize * sizeof(int)); + if (! dtd->scaffIndex) + return -1; diff -Nru expat-2.5.0/debian/patches/series expat-2.5.0/debian/patches/series --- expat-2.5.0/debian/patches/series 2022-09-21 16:42:18.000000000 +0000 +++ expat-2.5.0/debian/patches/series 2024-09-08 06:44:19.000000000 +0000 @@ -1,2 +1,5 @@ fix-expat-noconfig.patch fix-expat-cmake.patch +CVE-2024-45490.patch +CVE-2024-45491.patch +CVE-2024-45492.patch