CVE-2019-15903 : In libexpat before 2.2.8, crafted XML input could fool the parser into changing

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

Published 2019-09-04 06:15:11

Updated 2022-07-28 11:23:10

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2019-15903

Python » Python
Versions from including (>=) 3.7.0 and before (<) 3.7.5
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Matching versions
Python » Python
Versions from including (>=) 3.5.0 and before (<) 3.5.8
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Matching versions
Python » Python
Versions from including (>=) 2.7.0 and before (<) 2.7.17
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Matching versions
Python » Python
Versions from including (>=) 3.6.0 and before (<) 3.6.10
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Matching versions
Libexpat Project » Libexpat
Versions before (<) 2.2.8
cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2019-15903

Top countries where our scanners detected CVE-2019-15903

Top open port discovered on systems with this issue 80

IPs affected by CVE-2019-15903 172,701

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2019-15903!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2019-15903

EPSS FAQ

0.28%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 50 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-15903

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2019-15903

CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)
CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-15903

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/

[SECURITY] Fedora 31 Update: expat-2.2.8-1.fc31 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://seclists.org/bugtraq/2019/Dec/23

Bugtraq: APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.tenable.com/security/tns-2021-11

[R1] Nessus 8.15.0 Fixes Multiple Vulnerabilities - Security Advisory | Tenable®
Third Party Advisory

CVEs referencing this url
https://www.oracle.com/security-alerts/cpuoct2020.html

Oracle Critical Patch Update Advisory - October 2020
Third Party Advisory

CVEs referencing this url
https://seclists.org/bugtraq/2019/Sep/37

Bugtraq: [SECURITY] [DSA 4530-1] expat security update
Mailing List;Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html

Oracle Critical Patch Update Advisory - April 2020
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html

[security-announce] openSUSE-SU-2019:2447-1: important: Security update
Mailing List;Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html

[security-announce] openSUSE-SU-2019:2205-1: moderate: Security update f
Mailing List;Third Party Advisory
https://usn.ubuntu.com/4132-1/

USN-4132-1: Expat vulnerability | Ubuntu security notices
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html

[security-announce] openSUSE-SU-2019:2425-1: important: Security update
Mailing List;Third Party Advisory
http://seclists.org/fulldisclosure/2019/Dec/27

Full Disclosure: APPLE-SA-2019-12-10-5 tvOS 13.3
Mailing List;Third Party Advisory
http://seclists.org/fulldisclosure/2019/Dec/26

Full Disclosure: APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra
Mailing List;Third Party Advisory

CVEs referencing this url
http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html

Slackware Security Advisory - expat Updates ≈ Packet Storm
Third Party Advisory;VDB Entry
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/

[SECURITY] Fedora 29 Update: expat-2.2.8-1.fc29 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://www.debian.org/security/2019/dsa-4530

Debian -- Security Information -- DSA-4530-1 expat
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html

[security-announce] openSUSE-SU-2020:0010-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://seclists.org/bugtraq/2019/Nov/1

Bugtraq: [SECURITY] [DSA 4549-1] firefox-esr security update
Mailing List;Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html

[security-announce] openSUSE-SU-2019:2424-1: important: Security update
Mailing List;Third Party Advisory
http://seclists.org/fulldisclosure/2019/Dec/23

Full Disclosure: APPLE-SA-2019-12-10-1 iOS 13.3 and iPadOS 13.3
Mailing List;Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3210

RHSA-2019:3210 - Security Advisory - Red Hat Customer Portal
Third Party Advisory
https://github.com/libexpat/libexpat/issues/317

[CVE-2019-15903] Heap overflow in XML_GetCurrentLineNumber · Issue #317 · libexpat/libexpat · GitHub
Exploit;Issue Tracking;Third Party Advisory
https://support.apple.com/kb/HT210789

About the security content of watchOS 6.1.1 - Apple Support
Third Party Advisory

CVEs referencing this url
http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html

Slackware Security Advisory - python Updates ≈ Packet Storm
Third Party Advisory;VDB Entry

CVEs referencing this url
https://seclists.org/bugtraq/2019/Sep/30

Bugtraq: [slackware-security] expat (SSA:2019-259-01)
Mailing List;Third Party Advisory
https://usn.ubuntu.com/4202-1/

USN-4202-1: Thunderbird vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html

[security-announce] openSUSE-SU-2019:2452-1: important: Recommended upda
Mailing List;Third Party Advisory
https://www.debian.org/security/2019/dsa-4571

Debian -- Security Information -- DSA-4571-1 thunderbird
Third Party Advisory

CVEs referencing this url
https://support.apple.com/kb/HT210788

About the security content of macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra - Apple Support
Third Party Advisory

CVEs referencing this url
https://www.debian.org/security/2019/dsa-4549

Debian -- Security Information -- DSA-4549-1 firefox-esr
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

[security-announce] openSUSE-SU-2020:0086-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://usn.ubuntu.com/4132-2/

USN-4132-2: Expat vulnerability | Ubuntu security notices
Third Party Advisory
https://usn.ubuntu.com/4335-1/

USN-4335-1: Thunderbird vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/

[SECURITY] Fedora 30 Update: expat-2.2.8-1.fc30 - package-announce - Fedora Mailing-Lists
Third Party Advisory
http://seclists.org/fulldisclosure/2019/Dec/30

Full Disclosure: APPLE-SA-2019-12-10-8 watchOS 6.1.1
Mailing List;Third Party Advisory
https://support.apple.com/kb/HT210793

About the security content of iTunes 12.10.3 for Windows - Apple Support
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html

[security-announce] openSUSE-SU-2019:2464-1: important: Recommended upda
Mailing List;Third Party Advisory
https://github.com/libexpat/libexpat/pull/318

[CVE-2019-15903] Deny internal entities closing the doctype (for #317) by hartwork · Pull Request #318 · libexpat/libexpat · GitHub
Issue Tracking;Patch;Third Party Advisory
https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43

xmlparse.c: Deny internal entities closing the doctype · libexpat/libexpat@c20b758 · GitHub
Patch;Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html

[security-announce] openSUSE-SU-2019:2459-1: important: Security update
Mailing List;Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/11/msg00006.html

[SECURITY] [DLA 1987-1] firefox-esr security update
Mailing List;Third Party Advisory
https://security.netapp.com/advisory/ntap-20190926-0004/

CVE-2019-15903 Expat Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://seclists.org/bugtraq/2019/Oct/29

Bugtraq: [slackware-security] python (SSA:2019-293-01)
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html

[security-announce] openSUSE-SU-2019:2420-1: important: Security update
Mailing List;Third Party Advisory
https://github.com/libexpat/libexpat/issues/342

Release Expat 2.2.8 · Issue #342 · libexpat/libexpat · GitHub
Third Party Advisory
https://support.apple.com/kb/HT210795

About the security content of iCloud for Windows 7.16 - Apple Support
Third Party Advisory
https://seclists.org/bugtraq/2019/Nov/24

Bugtraq: [SECURITY] [DSA 4571-1] thunderbird security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2019/11/msg00017.html

[SECURITY] [DLA 1997-1] thunderbird security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://seclists.org/bugtraq/2019/Dec/17

Bugtraq: APPLE-SA-2019-12-10-8 watchOS 6.1.1
Mailing List;Third Party Advisory
https://usn.ubuntu.com/4165-1/

USN-4165-1: Firefox vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://support.apple.com/kb/HT210794

About the security content of iCloud for Windows 10.9 - Apple Support
Third Party Advisory
https://support.apple.com/kb/HT210790

About the security content of tvOS 13.3 - Apple Support
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:3237

RHSA-2019:3237 - Security Advisory - Red Hat Customer Portal
Third Party Advisory
https://security.gentoo.org/glsa/201911-08

Expat: Multiple vulnerabilities (GLSA 201911-08) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://seclists.org/bugtraq/2019/Dec/21

Bugtraq: APPLE-SA-2019-12-10-5 tvOS 13.3
Mailing List;Third Party Advisory
http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html

Slackware Security Advisory - mozilla-firefox Updates ≈ Packet Storm
Third Party Advisory;VDB Entry
https://support.apple.com/kb/HT210785

About the security content of iOS 13.3 and iPadOS 13.3 - Apple Support
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html

[security-announce] openSUSE-SU-2019:2451-1: important: Security update
Mailing List;Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3756

RHSA-2019:3756 - Security Advisory - Red Hat Customer Portal
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html

[security-announce] openSUSE-SU-2019:2204-1: moderate: Security update f
Mailing List;Third Party Advisory