CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

CVE details

CVE-2021-45960

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

Score
8.8 high
Published
2022-01-01
Links
NVD · cve.org

Affected ports (2)

PortPackageVersionStatusMaintainer
textproc/linux-c7-expatlinux-c7-expat2.1.0_5unaddressedemulation@FreeBSD.org
textproc/linux-c7-expat-devellinux-c7-expat-devel2.1.0_1unaddressedemulation@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>linux-c7-expat</name>
	<range><lt>2.4.3</lt></range>
      </package>
      <package>
	<name>linux-c7-expat-devel</name>
	<range><lt>2.4.3</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more)
	places in the storeAtts function in xmlparse.c can lead to realloc
	misbehavior (e.g., allocating too few bytes, or only freeing memory).</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2021-45960</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2021-45960</url>
    </references>
    <dates>
      <discovery>2022-01-01</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>