Integer overflow in expat - CVE-2021-46143

Vulnerability identifier: #VU59643

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2021-46143

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
expat
Amazon Linux AMI
Gentoo Linux
Oracle Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE MicroOS
SUSE Enterprise Storage
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Anolis OS
CentOS
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
IBM AIX
SUSE OpenStack Cloud
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
Red Hat Enterprise Linux Server - AUS
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
Oracle Solaris
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
Slackware Linux
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
Junos OS
openEuler
Brocade Fabric OS
HPE B-series SN6750B Fibre Channel Switch
HPE B-series SN6700B Fibre Channel Switch
HPE B-series SN6650B Fibre Channel Switch
HPE B-series SN6600B Fibre Channel Switch
HPE B-series SN4700B SAN Extension Switch
HPE B-series SN3600B Fibre Channel Switch
HPE B-series SN2600B SAN Extension Switch
HPE SN8600B 8-slot SAN Director Switch
HPE SN8600B 4-slot SAN Director Switch
HPE SN8700B 8-slot SAN Director Switch
HPE SN8700B 4-slot SAN Director Switch
Brocade 32Gb Fibre Channel SAN Switch for HPE Synergy
AFF66X FW
AFS660-C
AFS66X-B
AFS670-V20
AFS66X-S
AFS65X
AFS67X
AFR677
cflinuxfs3
Telemetry Dashboard
Storage Defender – Data Protect
Liquidware
Citrix Workspace App
Webex App VDI
EMC ECS
XtremIO X2
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
jbcs-httpd24-openssl-chil (Red Hat package)
jbcs-httpd24-brotli (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-apr (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-nghttp2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
expat (Debian package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
jbcs-httpd24-jansson (Red Hat package)
jbcs-httpd24-curl (Red Hat package)
lib64expat1 (Ubuntu package)
libxmltok1 (Ubuntu package)
libxmltok1t64 (Ubuntu package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
xmlrpc-c (Red Hat package)
libexpat1-32bit
libexpat1
expat
expat-debugsource
expat-debuginfo
expat-devel
expat-static
expat (Red Hat package)
expat-debuginfo-32bit
libexpat-devel
libexpat1-debuginfo-32bit
libexpat1-debuginfo
libexpat1 (Ubuntu package)
expat-32bit-debuginfo
libexpat1-32bit-debuginfo
expat-help
dev-libs/expat
firefox
firefox-debugsource
mozilla-crashreporter-firefox-debuginfo
firefox-debuginfo
Red Hat OpenShift GitOps
IBM QRadar Network Security
IBM QRadar Network Packet Capture
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
NetWorker Management Console
IBM Netezza Performance Portal
Red Hat Advanced Cluster Management for Kubernetes
IBM Cloud Object Storage Systems
Tenable Nessus
IBM Rational ClearCase
IBM Netezza Analytics for NPS
IBM Tivoli Monitoring
Steel Belted Radius Carrier Edition
IBM Cloud Pak System
IBM Netezza Analytics
Nessus Network Monitor
VMware Horizon Client
Migration Toolkit for Containers
SecurID Authentication Manager
Cisco Jabber
Cisco Webex Meetings
Red Hat OpenShift Serverless
JBoss Core Services
SINEMA Remote Connect Server
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
Juniper Junos Space

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the doProlog() function in xmlparse.c. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

• https://github.com/libexpat/libexpat/issues/532
• https://github.com/libexpat/libexpat/pull/538