Security update for expat

Announcement ID:	SUSE-SU-2022:2294-1
Rating:	important
References:	bsc#1196025 bsc#1196026 bsc#1196168 bsc#1196169 bsc#1196171 bsc#1196784
Cross-References:	CVE-2022-25235 CVE-2022-25236 CVE-2022-25313 CVE-2022-25314 CVE-2022-25315
CVSS scores:	CVE-2022-25235 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-25235 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-25236 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-25236 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2022-25313 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-25313 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2022-25314 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-25314 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-25315 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2022-25315 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:	Basesystem Module 15-SP4 openSUSE Leap 15.4 SUSE Linux Enterprise Desktop 15 SP4 SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise Real Time 15 SP4 SUSE Linux Enterprise Server 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3

An update that solves five vulnerabilities and has one security fix can now be installed.

Description:

This update for expat fixes the following issues:

• CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).
• Fixed a regression caused by the patch for CVE-2022-25236 (bsc#1196784).
• CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).
• CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).
• CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).
• CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• openSUSE Leap 15.4
  zypper in -t patch openSUSE-SLE-15.4-2022-2294=1
• Basesystem Module 15-SP4
  zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-2294=1

Package List:

• openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
  • libexpat-devel-2.4.4-150400.3.6.9
  • expat-2.4.4-150400.3.6.9
  • expat-debuginfo-2.4.4-150400.3.6.9
  • expat-debugsource-2.4.4-150400.3.6.9
  • libexpat1-2.4.4-150400.3.6.9
  • libexpat1-debuginfo-2.4.4-150400.3.6.9
• openSUSE Leap 15.4 (x86_64)
  • libexpat-devel-32bit-2.4.4-150400.3.6.9
  • expat-32bit-debuginfo-2.4.4-150400.3.6.9
  • libexpat1-32bit-debuginfo-2.4.4-150400.3.6.9
  • libexpat1-32bit-2.4.4-150400.3.6.9
• Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64)
  • libexpat-devel-2.4.4-150400.3.6.9
  • expat-2.4.4-150400.3.6.9
  • expat-debuginfo-2.4.4-150400.3.6.9
  • expat-debugsource-2.4.4-150400.3.6.9
  • libexpat1-2.4.4-150400.3.6.9
  • libexpat1-debuginfo-2.4.4-150400.3.6.9
• Basesystem Module 15-SP4 (x86_64)
  • libexpat1-32bit-2.4.4-150400.3.6.9
  • expat-32bit-debuginfo-2.4.4-150400.3.6.9
  • libexpat1-32bit-debuginfo-2.4.4-150400.3.6.9

References:

• https://www.suse.com/security/cve/CVE-2022-25235.html
• https://www.suse.com/security/cve/CVE-2022-25236.html
• https://www.suse.com/security/cve/CVE-2022-25313.html
• https://www.suse.com/security/cve/CVE-2022-25314.html
• https://www.suse.com/security/cve/CVE-2022-25315.html
• https://bugzilla.suse.com/show_bug.cgi?id=1196025
• https://bugzilla.suse.com/show_bug.cgi?id=1196026
• https://bugzilla.suse.com/show_bug.cgi?id=1196168
• https://bugzilla.suse.com/show_bug.cgi?id=1196169
• https://bugzilla.suse.com/show_bug.cgi?id=1196171
• https://bugzilla.suse.com/show_bug.cgi?id=1196784