GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3129 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-3129-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     October 01, 2022                            https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : gdal     Version        : 2.4.0+dfsg-1+deb10u1     CVE ID         : CVE-2019-17545 CVE-2021-45943

    Two issues were found in GDAL, a geospatial library, that could lead     to denial of service via application crash or possibly the execution     of arbitrary code if maliciously crafted data was parsed.

    For Debian 10 buster, these problems have been fixed in version     2.4.0+dfsg-1+deb10u1.

    We recommend that you upgrade your gdal packages.

    For the detailed security status of gdal please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/gdal

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2877 advisory.

  - GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB     threshold is exceeded. (CVE-2019-17545)

  - GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called     from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment).
    (CVE-2021-45943)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions     that are affected are 12.1.0.2 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Advanced     Networking Option, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in takeover of Advanced Networking Option. (CVE-2021-2351)

  - Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected     are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any     Procedure, Alter Any Table privilege with network access via Oracle Net to compromise Oracle Text.
    Successful   attacks of this vulnerability can result in takeover of Oracle Text. (CVE-2021-2328)

  - Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are     affected   are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having     Create Any   Procedure, Create Public Synonym privilege with network access via Oracle Net to compromise     Oracle XML DB.   Successful attacks of this vulnerability can result in takeover of Oracle XML DB.
    (CVE-2021-2329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update fixes CVE-2019-17545.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gdal to version 2.4.3 fixes the following issues :

gdal was updated to 2.4.3 :

  - CVE-2019-17545: Fixed a double free vulnerability in     OGRExpatRealloc (boo#1153918).

  - Multiple bug and stability fixes For more information     regarding the release at:
    https://trac.osgeo.org/gdal/wiki/Release/2.4.3-News

GDAL through 3.0.1 had a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold was exceeded.

For Debian 8 'Jessie', this problem has been fixed in version 1.10.1+dfsg-8+deb8u1.

We recommend that you upgrade your gdal packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
165604	Debian dla-3129 : gdal-bin - security update	Nessus	Debian Local Security Checks	critical
156691	Debian DLA-2877-1 : gdal - LTS security update	Nessus	Debian Local Security Checks	critical
152026	Oracle Database Server Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Databases	critical
131259	Fedora 31 : mingw-cfitsio / mingw-gdal (2019-f511b38b1f)	Nessus	Fedora Local Security Checks	critical
131257	Fedora 30 : mingw-gdal (2019-a6960910d8)	Nessus	Fedora Local Security Checks	critical
130891	openSUSE Security Update : gdal (openSUSE-2019-2466)	Nessus	SuSE Local Security Checks	critical
130769	Debian DLA-1984-1 : gdal security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-17545

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical