package: expat version: 1.95.8-3.4 Severity: serious Tags: security Hi, the following CVE (Common Vulnerabilities & Exposures) id was published for xpat.
CVE-2009-3560[0]: | The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, | as used in the XML-Twig module for Perl, allows context-dependent | attackers to cause a denial of service (application crash) via an XML | document with malformed UTF-8 sequences that trigger a buffer | over-read, related to the doProlog function in lib/xmlparse.c, a | different vulnerability than CVE-2009-2625 and CVE-2009-3720. I've checked etch and lenny. They are both affected by this issue. If you fix the vulnerability please also make sure to include the CVE id in your changelog entry. For further information see: [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3560 http://security-tracker.debian.org/tracker/CVE-2009-3560 -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
