-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4530-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
September 22, 2019                    https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : expat
CVE ID         : CVE-2019-15903
Debian Bug     : 939394

It was discovered that Expat, an XML parsing C library, did not properly
handled internal entities closing the doctype, potentially resulting in
denial of service or information disclosure if a malformed XML file is
processed.

For the oldstable distribution (stretch), this problem has been fixed
in version 2.2.0-2+deb9u3.

For the stable distribution (buster), this problem has been fixed in
version 2.2.6-2+deb10u1.

We recommend that you upgrade your expat packages.

For the detailed security status of expat please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/expat

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAl2HJHlfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0RrDg//d7+G9oQ9I1tIaopja+KfeJeAf9NN6qGTfemPeBoitDQhE6r7lIMB+/i7
r8yPIdTo6yt5u9KhJ2q2qnQjhaosqh5/Zus48K5lqrN+TMaoCjs/fMJBdWqXcnPv
5BsQyjelUVQ8aAiqGNfCSNIdmvDFbNic/x/bk1kqDXBQj145JMwkEz4hYsRf2HqD
tJYfnVEax3oD0L1RawW6PLUPKQ5lyWiwq+cXWA5lVNb4gIH1DZmVeUTlvbzgniz8
3WfwylztodKfTK139SsZGNM9wmmNZUmeBIBnlXGAW80fTZ6qI2XYmUevBCR4pVM8
SgHI2FxRqrbQjr9RX3u7Fnrwi+2weDQFxAncPSYBLzrJhoC/TdqhHsLXisYI6gFB
Bl3+fdnfh1KqYI/0JMVdee+aNM7N+macbvcwIOirYHwiB8MKC4mB4w5XO5CNjCb/
NGmt4rutAXWd2KL6ZiH9sqjnxnaqUCNjeXvVcSDzbnw9bS/aWu6G340+Idl9dLwE
RUPupv1eVILWbyy4lDSCqsvrvV3zbONkxG+QAZNmIOxe0PeriYtv3SrOXKfJxaut
eNnAruRTPvWE15doWKxAXTDD8A38rWoywWJFrWJ6P/X3TNPnbZfOvC4L6cOhqRnR
c1XThoFBS1DDgVRhgTsfWmSPodkoyWHNLwKr33qfabmw0NCxnLE­+U
-----END PGP SIGNATURE-----