1764170 - Expat vulnerabilities of 2022

Status: RESOLVED DUPLICATE of bug 1754724

(Core :: XML, defect)

Description

[argont]

Steps to reproduce:

According to [1], for instance, CVE-2022-23852 of libexpat is relevant for Thunderbird (and also Firefox). Fedora has recently added some patches for the embedded expat library to resolve CVE-2022-25235, CVE-2022-25236 and CVE-2022-25315, see [2].

If the libexpat vulnerabilities apply both to Thunderbird and Firefox, they should be fixed, I guess.

[1] https://ubuntu.com/security/CVE-2022-23852
[2] https://src.fedoraproject.org/rpms/thunderbird/tree/rawhide

Comment 1

[Magnus Melin [:mkmelin]]

This seems to be a webrtc dependency.

Comment 2

[argont]

Other bugs on expat, such as #741713 and #1713841, have the component XML assigned.

Comment 3

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

From what @mjf and I can tell, our WebRTC code does not depend on libexpat.

The imported third_party/libwebrtc folder contains files we use and some we don't, and we don't see libexpat in any of our third_party/libwebrtc moz.build files or BUILD.gn files...

...except for third_party/libwebrtc/build/config/android/internal_rules.gni which we're apparently executing parts of, but the path names it is building using that library list do not exist in our tree (third_party/android_build_tools/art/lib/), and some asserts confirmed that the template (template("dex")) that uses _default_art_libs is not used when we generate build files.

But thanks for running it by us, as it was a good thing to check!

Comment 4

[Hsin-Yi Tsai (she/her) [:hsinyi]]

I think we've addressed this in bug 1754724

Comment 6

[argont]

Thanks for the clarification and the fix.

FYI: this (expat in combination with Firefox and Thunderbird) has been (partially) covered by at least some german news site on January 28th in 2022: https://heise.de/-6341560.

Comment 7

[argont]

As I do not have access to the referenced other bug: are you allowed to give me an estimate on when this will land in the releases? Fedora still ships their patches with the current Thunderbird 91.8.0 release.

Comment 8

[Andrew McCreight [:mccr8]]

It looks like the patch was first shipped in Firefox 91.7esr.

https://hg.mozilla.org/releases/mozilla-esr91/rev/c084e1e90301ca414be9dee690a3ca9ebc2a0a0e
and a few other commits at the same time