<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On 24 December 2015 at 02:59, Zhixiong Chi <span dir="ltr">&lt;<a href="mailto:Zhixiong.Chi@windriver.com" target="_blank">Zhixiong.Chi@windriver.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div id=":g8" class="a3s" style="overflow:hidden">+++ b/meta/recipes-core/expat/expat-2.1.0/expat-CVE-2015-1283.patch<br>
@@ -0,0 +1,58 @@<br>
+Multiple integer overflows in the XML_GetBuffer function in Expat<br>
+through 2.1.0, allow remote attackers to cause a denial of service<br>
+(heap-based buffer overflow) or possibly have unspecified other<br>
+impact via crafted XML data.<br>
+<br>
+CVSSv2:  (AV:N/AC:M/Au:N/C:P/I:P/A:P)<br>
+<br>
+Upstream-Status: Backport<br>
+<br>
+Index: expat-2.1.0/lib/xmlparse.c</div></blockquote></div><br>No signed-off-by in the patch.  Also can we experiment with a CVE tag in the patch alongside the upstream-status and s-o-b?  &quot;CVE: CVE-2015-1283&quot;.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Thanks,</div><div class="gmail_extra">Ross</div></div>