Expat CVE-2017-9233 XML External Entity Denial of Service Vulnerability

Bugtraq ID:	99276
Class:	Input Validation Error
CVE:	CVE-2017-9233
Remote:	Yes
Local:	No
Published:	Jun 26 2017 12:00AM
Updated:	Jun 26 2017 12:00AM
Credit:	Rhodri James
Vulnerable:	Redhat Enterprise Linux 5 Expat Expat 2.2 Expat Expat 2.1 Expat Expat 2.0.1 Expat Expat 2.0 Expat Expat 1.95.8 Expat Expat 1.95.7 Expat Expat 1.95.6 Expat Expat 1.95.5 Expat Expat 2.1.1
Not Vulnerable:	Expat Expat 2.2.1

Expat CVE-2017-9233 XML External Entity Denial of Service Vulnerability

Expat is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause a denial of service condition.

Expat CVE-2017-9233 XML External Entity Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Expat CVE-2017-9233 XML External Entity Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Expat CVE-2017-9233 XML External Entity Denial of Service Vulnerability

References:

• Expat Homepage (Expat)
  
• Bug 1462729 - (CVE-2017-9233) CVE-2017-9233 expat: Inifinite loop due to invalid (Redhat)
  
• CVE-2017-9233 (Redhat)
  
• External Entity Vulnerability in Expat 2.2.0 And Earlier (libexpat)
  
• xmlparse.c: Fix external entity infinite loop bug (CVE-2017-9233) (GitHub)