5 - USN-3356-1

Executive Summary

Summary
Title	Expat vulnerability

Informations
Name	USN-3356-1	First vendor Publication	2017-07-19
Vendor	Ubuntu	Last vendor Modification	2017-07-19
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.04 - Ubuntu 16.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS

Summary:

Expat could be made to hang if it received specially crafted input.

Software Description: - expat: XML parsing C library

Details:

It was discovered that Expat incorrectly handled certain external entities. A remote attacker could possibly use this issue to cause Expat to hang, resulting in a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 17.04:
lib64expat1 2.2.0-2ubuntu0.1
libexpat1 2.2.0-2ubuntu0.1

Ubuntu 16.10:
lib64expat1 2.2.0-1ubuntu0.1
libexpat1 2.2.0-1ubuntu0.1

Ubuntu 16.04 LTS:
lib64expat1 2.1.0-7ubuntu0.16.04.3
libexpat1 2.1.0-7ubuntu0.16.04.3

Ubuntu 14.04 LTS:
lib64expat1 2.1.0-4ubuntu1.4
libexpat1 2.1.0-4ubuntu1.4

In general, a standard system update will make all the necessary changes.

References:
https://www.ubuntu.com/usn/usn-3356-1
CVE-2017-9233

Package Information:
https://launchpad.net/ubuntu/+source/expat/2.2.0-2ubuntu0.1
https://launchpad.net/ubuntu/+source/expat/2.2.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/expat/2.1.0-7ubuntu0.16.04.3
https://launchpad.net/ubuntu/+source/expat/2.1.0-4ubuntu1.4

Original Source

Url : http://www.ubuntu.com/usn/USN-3356-1

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-611	Information Leak Through XML External Entity File Disclosure

CPE : Common Platform Enumeration

Type	Description	Count
Application	Libexpat Project Libexpat cpe:2.3:a:libexpat_project:libexpat:2.0.1:::::::* cpe:2.3:a:libexpat_project:libexpat:2.0.0:::::::* cpe:2.3:a:libexpat_project:libexpat:1.95.8:::::::* cpe:2.3:a:libexpat_project:libexpat:1.95.7:::::::* cpe:2.3:a:libexpat_project:libexpat:1.95.6:::::::* cpe:2.3:a:libexpat_project:libexpat:1.95.5:::::::* cpe:2.3:a:libexpat_project:libexpat:1.95.4:::::::* cpe:2.3:a:libexpat_project:libexpat:1.95.2:::::::* cpe:2.3:a:libexpat_project:libexpat:1.95.1:::::::* cpe:2.3:a:libexpat_project:libexpat::::::::	10
Application	Python cpe:2.3:a:python:python:3.6.1:-:::::: cpe:2.3:a:python:python:3.6.1:rc1:::::: cpe:2.3:a:python:python:3.6.0:-:::::: cpe:2.3:a:python:python:3.6.0:alpha1:::::: cpe:2.3:a:python:python:3.6.0:alpha2:::::: cpe:2.3:a:python:python:3.6.0:alpha3:::::: cpe:2.3:a:python:python:3.6.0:alpha4:::::: cpe:2.3:a:python:python:3.6.0:beta1:::::: cpe:2.3:a:python:python:3.6.0:beta2:::::: cpe:2.3:a:python:python:3.6.0:beta3:::::: cpe:2.3:a:python:python:3.6.0:beta4:::::: cpe:2.3:a:python:python:3.6.0:rc1:::::: cpe:2.3:a:python:python:3.6.0:rc2:::::: cpe:2.3:a:python:python:3.5.7:-:::::: cpe:2.3:a:python:python:3.5.7:rc1:::::: cpe:2.3:a:python:python:3.5.6:-:::::: cpe:2.3:a:python:python:3.5.6:rc1:::::: cpe:2.3:a:python:python:3.5.5:-:::::: cpe:2.3:a:python:python:3.5.5:rc1:::::: cpe:2.3:a:python:python:3.5.4:-:::::: cpe:2.3:a:python:python:3.5.4:rc1:::::: cpe:2.3:a:python:python:3.5.3:-:::::: cpe:2.3:a:python:python:3.5.3:rc1:::::: cpe:2.3:a:python:python:3.5.2:-:::::: cpe:2.3:a:python:python:3.5.2:rc1:::::: cpe:2.3:a:python:python:3.5.1:-:::::: cpe:2.3:a:python:python:3.5.1:rc1:::::: cpe:2.3:a:python:python:3.5.0:-:::::: cpe:2.3:a:python:python:3.5.0:alpha1:::::: cpe:2.3:a:python:python:3.5.0:alpha2:::::: cpe:2.3:a:python:python:3.5.0:alpha3:::::: cpe:2.3:a:python:python:3.5.0:alpha4:::::: cpe:2.3:a:python:python:3.5.0:beta1:::::: cpe:2.3:a:python:python:3.5.0:beta2:::::: cpe:2.3:a:python:python:3.5.0:beta3:::::: cpe:2.3:a:python:python:3.5.0:beta4:::::: cpe:2.3:a:python:python:3.5.0:rc1:::::: cpe:2.3:a:python:python:3.5.0:rc2:::::: cpe:2.3:a:python:python:3.5.0:rc3:::::: cpe:2.3:a:python:python:3.5.0:rc4:::::: cpe:2.3:a:python:python:3.4.9:-:::::: cpe:2.3:a:python:python:3.4.9:rc1:::::: cpe:2.3:a:python:python:3.4.8:-:::::: cpe:2.3:a:python:python:3.4.8:rc1:::::: cpe:2.3:a:python:python:3.4.7:-:::::: cpe:2.3:a:python:python:3.4.7:rc1:::::: cpe:2.3:a:python:python:3.4.6:-:::::: cpe:2.3:a:python:python:3.4.6:rc1:::::: cpe:2.3:a:python:python:3.4.5:-:::::: cpe:2.3:a:python:python:3.4.5:rc1:::::: cpe:2.3:a:python:python:3.4.4:-:::::: cpe:2.3:a:python:python:3.4.4:rc1:::::: cpe:2.3:a:python:python:3.4.3:-:::::: cpe:2.3:a:python:python:3.4.3:rc1:::::: cpe:2.3:a:python:python:3.4.2:-:::::: cpe:2.3:a:python:python:3.4.2:rc1:::::: cpe:2.3:a:python:python:3.4.10:-:::::: cpe:2.3:a:python:python:3.4.10:rc1:::::: cpe:2.3:a:python:python:3.4.1:-:::::: cpe:2.3:a:python:python:3.4.1:rc1:::::: cpe:2.3:a:python:python:3.4.0:-:::::: cpe:2.3:a:python:python:3.4.0:alpha1:::::: cpe:2.3:a:python:python:3.4.0:alpha2:::::: cpe:2.3:a:python:python:3.4.0:alpha3:::::: cpe:2.3:a:python:python:3.4.0:alpha4:::::: cpe:2.3:a:python:python:3.4.0:beta1:::::: cpe:2.3:a:python:python:3.4.0:beta2:::::: cpe:2.3:a:python:python:3.4.0:beta3:::::: cpe:2.3:a:python:python:3.4.0:rc1:::::: cpe:2.3:a:python:python:3.4.0:rc2:::::: cpe:2.3:a:python:python:3.4.0:rc3:::::: cpe:2.3:a:python:python:3.4:alpha1:::::: cpe:2.3:a:python:python:3.3.7:-:::::: cpe:2.3:a:python:python:3.3.7:rc1:::::: cpe:2.3:a:python:python:3.3.6:rc1:::::: cpe:2.3:a:python:python:3.3.6:-:::::: cpe:2.3:a:python:python:3.3.5:rc2:::::: cpe:2.3:a:python:python:3.3.5:-:::::: cpe:2.3:a:python:python:3.3.5:rc1:::::: cpe:2.3:a:python:python:3.3.4:rc1:::::: cpe:2.3:a:python:python:3.3.4:-:::::: cpe:2.3:a:python:python:3.3.3:rc1:::::: cpe:2.3:a:python:python:3.3.3:rc2:::::: cpe:2.3:a:python:python:3.3.3:-:::::: cpe:2.3:a:python:python:3.3.2:::::::* cpe:2.3:a:python:python:3.3.1:rc1:::::: cpe:2.3:a:python:python:3.3.1:-:::::: cpe:2.3:a:python:python:3.3.0:-:::::: cpe:2.3:a:python:python:3.3.0:alpha1:::::: cpe:2.3:a:python:python:3.3.0:alpha2:::::: cpe:2.3:a:python:python:3.3.0:alpha3:::::: cpe:2.3:a:python:python:3.3.0:alpha4:::::: cpe:2.3:a:python:python:3.3.0:beta1:::::: cpe:2.3:a:python:python:3.3.0:beta2:::::: cpe:2.3:a:python:python:3.3.0:rc1:::::: cpe:2.3:a:python:python:3.3.0:rc2:::::: cpe:2.3:a:python:python:3.3.0:rc3:::::: cpe:2.3:a:python:python:3.3:beta2:::::: cpe:2.3:a:python:python:3.3:::::::* cpe:2.3:a:python:python:3.2.6:-:::::: cpe:2.3:a:python:python:3.2.6:rc1:::::: cpe:2.3:a:python:python:3.2.5:::::::* cpe:2.3:a:python:python:3.2.4:-:::::: cpe:2.3:a:python:python:3.2.4:rc1:::::: cpe:2.3:a:python:python:3.2.3:-:::::: cpe:2.3:a:python:python:3.2.3:rc1:::::: cpe:2.3:a:python:python:3.2.3:rc2:::::: cpe:2.3:a:python:python:3.2.2150:::::::* cpe:2.3:a:python:python:3.2.2:-:::::: cpe:2.3:a:python:python:3.2.2:rc1:::::: cpe:2.3:a:python:python:3.2.1:-:::::: cpe:2.3:a:python:python:3.2.1:beta1:::::: cpe:2.3:a:python:python:3.2.1:rc1:::::: cpe:2.3:a:python:python:3.2.1:rc2:::::: cpe:2.3:a:python:python:3.2.0:::::::* cpe:2.3:a:python:python:3.2:alpha:::::: cpe:2.3:a:python:python:3.2:-:::::: cpe:2.3:a:python:python:3.2:alpha1:::::: cpe:2.3:a:python:python:3.2:alpha2:::::: cpe:2.3:a:python:python:3.2:alpha3:::::: cpe:2.3:a:python:python:3.2:alpha4:::::: cpe:2.3:a:python:python:3.2:beta1:::::: cpe:2.3:a:python:python:3.2:beta2:::::: cpe:2.3:a:python:python:3.2:rc1:::::: cpe:2.3:a:python:python:3.2:rc2:::::: cpe:2.3:a:python:python:3.2:rc3:::::: cpe:2.3:a:python:python:3.1.5:-:::::: cpe:2.3:a:python:python:3.1.5:rc1:::::: cpe:2.3:a:python:python:3.1.5:rc2:::::: cpe:2.3:a:python:python:3.1.4:-:::::: cpe:2.3:a:python:python:3.1.4:rc1:::::: cpe:2.3:a:python:python:3.1.3:-:::::: cpe:2.3:a:python:python:3.1.3:rc1:::::: cpe:2.3:a:python:python:3.1.2150::::::x64: cpe:2.3:a:python:python:3.1.2:-:::::: cpe:2.3:a:python:python:3.1.2:rc1:::::: cpe:2.3:a:python:python:3.1.1:-:::::: cpe:2.3:a:python:python:3.1.1:rc1:::::: cpe:2.3:a:python:python:3.1.0:::::::* cpe:2.3:a:python:python:3.1:-:::::: cpe:2.3:a:python:python:3.1:alpha1:::::: cpe:2.3:a:python:python:3.1:alpha2:::::: cpe:2.3:a:python:python:3.1:beta1:::::: cpe:2.3:a:python:python:3.1:rc1:::::: cpe:2.3:a:python:python:3.1:rc2:::::: cpe:2.3:a:python:python:3.0.1:::::::* cpe:2.3:a:python:python:3.0.0:::::::* cpe:2.3:a:python:python:3.0:-:::::: cpe:2.3:a:python:python:3.0:alpha1:::::: cpe:2.3:a:python:python:3.0:alpha2:::::: cpe:2.3:a:python:python:3.0:alpha3:::::: cpe:2.3:a:python:python:3.0:alpha4:::::: cpe:2.3:a:python:python:3.0:alpha5:::::: cpe:2.3:a:python:python:3.0:beta1:::::: cpe:2.3:a:python:python:3.0:beta2:::::: cpe:2.3:a:python:python:3.0:beta3:::::: cpe:2.3:a:python:python:3.0:rc1:::::: cpe:2.3:a:python:python:3.0:rc2:::::: cpe:2.3:a:python:python:3.0:rc3:::::: cpe:2.3:a:python:python:2.7.9:-:::::: cpe:2.3:a:python:python:2.7.9:rc1:::::: cpe:2.3:a:python:python:2.7.8:::::::* cpe:2.3:a:python:python:2.7.7:-:::::: cpe:2.3:a:python:python:2.7.7:rc1:::::: cpe:2.3:a:python:python:2.7.6:-:::::: cpe:2.3:a:python:python:2.7.6:rc1:::::: cpe:2.3:a:python:python:2.7.5:::::::* cpe:2.3:a:python:python:2.7.4:-:::::: cpe:2.3:a:python:python:2.7.4:rc1:::::: cpe:2.3:a:python:python:2.7.3:-:::::: cpe:2.3:a:python:python:2.7.3:rc1:::::: cpe:2.3:a:python:python:2.7.3:rc2:::::: cpe:2.3:a:python:python:2.7.2150:::::::* cpe:2.3:a:python:python:2.7.2:rc1:::::: cpe:2.3:a:python:python:2.7.2:-:::::: cpe:2.3:a:python:python:2.7.16:-:::::: cpe:2.3:a:python:python:2.7.16:rc1:::::: cpe:2.3:a:python:python:2.7.16:::::::* cpe:2.3:a:python:python:2.7.15:-:::::: cpe:2.3:a:python:python:2.7.15:rc1:::::: cpe:2.3:a:python:python:2.7.14:-:::::: cpe:2.3:a:python:python:2.7.14:rc1:::::: cpe:2.3:a:python:python:2.7.13:-:::::: cpe:2.3:a:python:python:2.7.13:rc1:::::: cpe:2.3:a:python:python:2.7.12:-:::::: cpe:2.3:a:python:python:2.7.12:rc1:::::: cpe:2.3:a:python:python:2.7.1150:::::::* cpe:2.3:a:python:python:2.7.1150::::::x64: cpe:2.3:a:python:python:2.7.11:-:::::: cpe:2.3:a:python:python:2.7.11:rc1:::::: cpe:2.3:a:python:python:2.7.10:-:::::: cpe:2.3:a:python:python:2.7.10:rc1:::::: cpe:2.3:a:python:python:2.7.1:-:::::: cpe:2.3:a:python:python:2.7.1:rc1:::::: cpe:2.3:a:python:python:2.7.0:::::::* cpe:2.3:a:python:python:2.6.9:::::::* cpe:2.3:a:python:python:2.6.8:::::::* cpe:2.3:a:python:python:2.6.7:::::::* cpe:2.3:a:python:python:2.6.6150:::::::* cpe:2.3:a:python:python:2.6.6:::::::* cpe:2.3:a:python:python:2.6.5:::::::* cpe:2.3:a:python:python:2.6.4:::::::* cpe:2.3:a:python:python:2.6.3:::::::* cpe:2.3:a:python:python:2.6.2150:::::::* cpe:2.3:a:python:python:2.6.2:::::::* cpe:2.3:a:python:python:2.6.1:::::::* cpe:2.3:a:python:python:2.6.0:::::::* cpe:2.3:a:python:python:2.5.6:::::::* cpe:2.3:a:python:python:2.5.5:::::::* cpe:2.3:a:python:python:2.5.4:::::::* cpe:2.3:a:python:python:2.5.3:::::::* cpe:2.3:a:python:python:2.5.2:::::::* cpe:2.3:a:python:python:2.5.150:::::::* cpe:2.3:a:python:python:2.5.1:::::::* cpe:2.3:a:python:python:2.5.0:::::::* cpe:2.3:a:python:python:2.4.6:::::::* cpe:2.3:a:python:python:2.4.5:::::::* cpe:2.3:a:python:python:2.4.4:::::::* cpe:2.3:a:python:python:2.4.3:::::::* cpe:2.3:a:python:python:2.4.2:::::::* cpe:2.3:a:python:python:2.4.1:::::::* cpe:2.3:a:python:python:2.4.0:::::::* cpe:2.3:a:python:python:2.3.7:::::::* cpe:2.3:a:python:python:2.3.6:::::::* cpe:2.3:a:python:python:2.3.5:::::::* cpe:2.3:a:python:python:2.3.4:::::::* cpe:2.3:a:python:python:2.3.3:::::::* cpe:2.3:a:python:python:2.3.2:::::::* cpe:2.3:a:python:python:2.3.1:::::::* cpe:2.3:a:python:python:2.3.0:::::::* cpe:2.3:a:python:python:2.2.3:::::::* cpe:2.3:a:python:python:2.2.2:::::::* cpe:2.3:a:python:python:2.2.1:::::::* cpe:2.3:a:python:python:2.2.0:::::::* cpe:2.3:a:python:python:2.2:::::::* cpe:2.3:a:python:python:2.1.3:::::::* cpe:2.3:a:python:python:2.1.2:::::::* cpe:2.3:a:python:python:2.1.1:::::::* cpe:2.3:a:python:python:2.1:::::::* cpe:2.3:a:python:python:2.0.1:::::::* cpe:2.3:a:python:python:2.0:::::::* cpe:2.3:a:python:python:1.6.1:::::::* cpe:2.3:a:python:python:1.6:::::::* cpe:2.3:a:python:python:1.5.2:::::::* cpe:2.3:a:python:python:1.3:::::::* cpe:2.3:a:python:python:1.2:::::::* cpe:2.3:a:python:python:0.9.1:::::::* cpe:2.3:a:python:python:0.9.0:::::::* cpe:2.3:a:python:python:::::::: cpe:2.3:a:python:python:-:::::::*	250
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:10.0:::::::* cpe:2.3:o:debian:debian_linux:9.0:::::::* cpe:2.3:o:debian:debian_linux:8.0:::::::*	3

Nessus® Vulnerability Scanner

Date	Description
2018-07-06	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_e375ff3f7fec11e8808828d244aee256.nasl - Type : ACT_GATHER_INFO
2018-05-07	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2018-124-01.nasl - Type : ACT_GATHER_INFO
2018-05-07	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_8719b9358bae41ad92ba3c826f651219.nasl - Type : ACT_GATHER_INFO
2017-10-12	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_9164f51eae2011e7a633009c02a2ab30.nasl - Type : ACT_GATHER_INFO
2017-10-03	Name : The remote host is missing a macOS update that fixes multiple security vulner... File : macos_10_13.nasl - Type : ACT_GATHER_INFO
2017-09-25	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2017-266-02.nasl - Type : ACT_GATHER_INFO
2017-09-07	Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-2375-1.nasl - Type : ACT_GATHER_INFO
2017-09-05	Name : The remote openSUSE host is missing a security update. File : openSUSE-2017-993.nasl - Type : ACT_GATHER_INFO
2017-08-31	Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-2299-1.nasl - Type : ACT_GATHER_INFO
2017-07-20	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-3356-1.nasl - Type : ACT_GATHER_INFO
2017-07-19	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2017-199-01.nasl - Type : ACT_GATHER_INFO
2017-07-17	Name : The remote Fedora host is missing a security update. File : fedora_2017-18601ad5d2.nasl - Type : ACT_GATHER_INFO
2017-07-13	Name : The remote Fedora host is missing a security update. File : fedora_2017-2c5635cd97.nasl - Type : ACT_GATHER_INFO
2017-07-13	Name : The remote Fedora host is missing a security update. File : fedora_2017-a44f9aa38b.nasl - Type : ACT_GATHER_INFO
2017-06-26	Name : The remote Debian host is missing a security-related update. File : debian_DSA-3898.nasl - Type : ACT_GATHER_INFO
2017-06-19	Name : The remote Debian host is missing a security update. File : debian_DLA-990.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2019-01-08 00:18:56	First insertion

Global Informations

Type	Count
CWE ID(s)	1
CPE ID(s)	263
Nessus® Exploit(s)	16

	Related
7.5	CVE-2017-9233
0	USN-3356-2
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)

5 - USN-3356-1

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

CPE : Common Platform Enumeration

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU