8609 2015-10-29 12:15:09 +0000 expat 2.1.0 has open CVE 2015-11-05 10:37:41 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core unspecified x86 Multiple VERIFIED WONTFIX Medium+ normal 2.0 1 elena.reshetova akuster alexandru.c.georgescu bluelightning bogdanx.a.voiculescu meta.mr.watcher meta.watcher sona.sarmadi alexandru.c.georgescu --- --- No (bug/feature does not impact docs) oldest_to_newest 55981 0 elena.reshetova 2015-10-29 12:15:09 +0000 expat 2.1.0 has open CVE-2013-0340 55998 1 bluelightning 2015-10-29 14:11:48 +0000 Is there actually anything to be done about this CVE? From what I can tell the general consensus was to assign CVEs for applications that use it that are vulnerable and do nothing specifically about this CVE itself: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0340 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0340 http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-0340.html 56010 2 bluelightning 2015-10-29 15:05:10 +0000 Marking as NEEDINFO as per above comment. 56015 3 akuster 2015-10-29 15:45:26 +0000 The CVSS score on this is medium. this issue is on the App developer not expact 2.1.0 Applications linked with expat can mitigate this issue, by calling the XML_SetEntityDeclHandler() function with the name of an alternative function that can handle entities more safely. Since API levels mitigations are in place, closing this as wontfix. 56120 4 alexandru.c.georgescu 2015-11-03 08:27:59 +0000 Verified as per above comments.