CVE-2019-15903: High severity Apple tvOS vulnerability
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XMLGetCurrentLineNumber (or XMLGetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
Other sources
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early. A subsequent call to XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber then resulted in a heap-based buffer over-read.
— Mozilla
libexpat is vulnerable to a denial of service, caused by a heap-based buffer over-read in XMLGetCurrentLineNumber. By using a specially-crafted XML input, a remote attacker could exploit this vulnerability to cause the application to crash.
— IBM
libexpat. This issue was addressed by updating to expat version 2.2.8.
Credit
Affected Software
Remediation
Patch Available
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2019-8834
- CVE-2019-8848
- CVE-2019-8830
- CVE-2019-8833
- CVE-2019-8828
- CVE-2019-8838
- CVE-2019-15903
- CVE-2019-15161
- CVE-2019-15162
- CVE-2019-15163
- CVE-2019-15164
- CVE-2019-15165
- CVE-2019-8832
- CVE-2019-8898
- CVE-2019-8835
- CVE-2019-8844
- CVE-2019-8846
- CVE-2019-8837
- CVE-2019-8853
- CVE-2019-8856
- CVE-2019-8842
- CVE-2019-8839
- CVE-2019-8851
- CVE-2019-8847
- CVE-2019-8852
- CVE-2020-9782
- CVE-2012-1164
- CVE-2012-2668
- CVE-2013-4449
- CVE-2015-1545
- CVE-2019-13057
- CVE-2019-13565
- CVE-2017-16808
- CVE-2018-10103
- CVE-2018-10105
- CVE-2018-14461
- CVE-2018-14462
- CVE-2018-14463
- CVE-2018-14464
- CVE-2018-14465
- CVE-2018-14466
- CVE-2018-14467
- CVE-2018-14468
- CVE-2018-14469
- CVE-2018-14470
- CVE-2018-14879
- CVE-2018-14880
- CVE-2018-14881
- CVE-2018-14882
- CVE-2018-16227
- CVE-2018-16228
- CVE-2018-16229
- CVE-2018-16230
- CVE-2018-16300
- CVE-2018-16301
- CVE-2018-16451
- CVE-2018-16452
- CVE-2019-15166
- CVE-2019-15167
- CVE-2019-15126
- CVE-2019-11757
- CVE-2019-11758
- CVE-2019-11759
- CVE-2019-11760
- CVE-2019-11761
- CVE-2019-11762
- CVE-2019-11763
- CVE-2019-11764
- CVE-2018-6156
- CVE-2019-25136
- CVE-2020-12412
- CVE-2019-11765
- CVE-2019-17000
- CVE-2019-17001
- CVE-2019-17002
- CVE-2019-8841
- CVE-2019-8857
Frequently Asked Questions
What is CVE-2019-15903?
CVE-2019-15903 is a vulnerability in libexpat before version 2.2.8 that could result in a heap-based buffer over-read.
Which software products are affected by CVE-2019-15903?
Mozilla Firefox ESR versions up to 68.2, Mozilla Thunderbird versions up to 68.2, and Mozilla Firefox versions up to 70 are affected by CVE-2019-15903. Additionally, the expat package versions up to 2.2.8 are also affected.
What is the severity of CVE-2019-15903?
CVE-2019-15903 has a severity rating of high.
How can I fix CVE-2019-15903?
To fix CVE-2019-15903, update to expat version 2.2.8. For Mozilla products, update to the respective patched versions mentioned in the Mozilla security advisories.
Where can I find more information about CVE-2019-15903?
You can find more information about CVE-2019-15903 in the provided references: [1], [2], [3].