CVE-2019-15903
Python 3.6 and 2 others: Out-of-bounds Read
CVE-2019-15903 is fixed in 20 products on 2 platforms, first by chromium-browser 78.0.3904.70-0ubuntu1, released September 3, 2019. 2 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: High.
HighFixed on 2 platforms
CVSS
7.5
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0664
93rd percentile
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Python 3.7 | 3.7.5 | Python 3.7 3.7.5 | Oct 14, 2019 |
| Linux | |||
| chromium-browser · Ubuntu 18.04.6 LTS (bionic) | 78.0.3904.70-0ubuntu0.18.04.2 | chromium-browser 78.0.3904.70-0ubuntu0.18.04.2 | Nov 25, 2019 |
| chromium-browser · Ubuntu 20.04 LTS (focal) | 78.0.3904.70-0ubuntu1 | chromium-browser 78.0.3904.70-0ubuntu1 | Sep 3, 2019 |
| chromium-browser · Ubuntu 24.10 (oracular) | 78.0.3904.70-0ubuntu1 | chromium-browser 78.0.3904.70-0ubuntu1 | Sep 4, 2019 |
| chromium-browser · Ubuntu 25.04 (plucky) | 78.0.3904.70-0ubuntu1 | chromium-browser 78.0.3904.70-0ubuntu1 | Sep 4, 2019 |
| chromium-browser-l10n · Ubuntu 18.04.6 LTS (bionic) | 78.0.3904.70-0ubuntu0.18.04.2 | chromium-browser-l10n 78.0.3904.70-0ubuntu0.18.04.2 | Nov 25, 2019 |
| chromium-browser-l10n · Ubuntu 20.04 LTS (focal) | 78.0.3904.70-0ubuntu1 | chromium-browser-l10n 78.0.3904.70-0ubuntu1 | Sep 3, 2019 |
| chromium-browser-l10n · Ubuntu 24.10 (oracular) | 78.0.3904.70-0ubuntu1 | chromium-browser-l10n 78.0.3904.70-0ubuntu1 | Sep 4, 2019 |
| chromium-browser-l10n · Ubuntu 25.04 (plucky) | 78.0.3904.70-0ubuntu1 | chromium-browser-l10n 78.0.3904.70-0ubuntu1 | Sep 4, 2019 |
| chromium-chromedriver · Ubuntu 18.04.6 LTS (bionic) | 78.0.3904.70-0ubuntu0.18.04.2 | chromium-chromedriver 78.0.3904.70-0ubuntu0.18.04.2 | Nov 25, 2019 |
| chromium-chromedriver · Ubuntu 20.04 LTS (focal) | 78.0.3904.70-0ubuntu1 | chromium-chromedriver 78.0.3904.70-0ubuntu1 | Sep 3, 2019 |
| chromium-chromedriver · Ubuntu 24.10 (oracular) | 78.0.3904.70-0ubuntu1 | chromium-chromedriver 78.0.3904.70-0ubuntu1 | Sep 4, 2019 |
| chromium-chromedriver · Ubuntu 25.04 (plucky) | 78.0.3904.70-0ubuntu1 | chromium-chromedriver 78.0.3904.70-0ubuntu1 | Sep 4, 2019 |
| chromium-codecs-ffmpeg · Ubuntu 18.04.6 LTS (bionic) | 78.0.3904.70-0ubuntu0.18.04.2 | chromium-codecs-ffmpeg 78.0.3904.70-0ubuntu0.18.04.2 | Nov 25, 2019 |
| chromium-codecs-ffmpeg · Ubuntu 20.04 LTS (focal) | 78.0.3904.70-0ubuntu1 | chromium-codecs-ffmpeg 78.0.3904.70-0ubuntu1 | Sep 3, 2019 |
| chromium-codecs-ffmpeg · Ubuntu 24.10 (oracular) | 78.0.3904.70-0ubuntu1 | chromium-codecs-ffmpeg 78.0.3904.70-0ubuntu1 | Sep 4, 2019 |
| chromium-codecs-ffmpeg · Ubuntu 25.04 (plucky) | 78.0.3904.70-0ubuntu1 | chromium-codecs-ffmpeg 78.0.3904.70-0ubuntu1 | Sep 4, 2019 |
| chromium-codecs-ffmpeg-extra · Ubuntu 18.04.6 LTS (bionic) | 78.0.3904.70-0ubuntu0.18.04.2 | chromium-codecs-ffmpeg-extra 78.0.3904.70-0ubuntu0.18.04.2 | Nov 25, 2019 |
| chromium-codecs-ffmpeg-extra · Ubuntu 20.04 LTS (focal) | 78.0.3904.70-0ubuntu1 | chromium-codecs-ffmpeg-extra 78.0.3904.70-0ubuntu1 | Sep 3, 2019 |
| chromium-codecs-ffmpeg-extra · Ubuntu 24.10 (oracular) | 78.0.3904.70-0ubuntu1 | chromium-codecs-ffmpeg-extra 78.0.3904.70-0ubuntu1 | Sep 4, 2019 |
| chromium-codecs-ffmpeg-extra · Ubuntu 25.04 (plucky) | 78.0.3904.70-0ubuntu1 | chromium-codecs-ffmpeg-extra 78.0.3904.70-0ubuntu1 | Sep 4, 2019 |
| expat · RHEL 8 | 0:2.2.5-4.el8 | RHSA-2020:4484 | Nov 4, 2020 |
| expat · Ubuntu 18.04.6 LTS (bionic) | 2.2.5-3ubuntu0.2 | expat 2.2.5-3ubuntu0.2 | Sep 3, 2019 |
| expat · ol 8 | 0:2.2.5-4.el8 | ELSA-2020-4484 | Nov 10, 2020 |
| expat-devel · RHEL 8 | 0:2.2.5-4.el8 | RHSA-2020:4484 | Nov 4, 2020 |
| expat-devel · ol 8 | 0:2.2.5-4.el8 | ELSA-2020-4484 | Nov 10, 2020 |
| firefox · RHEL 8 | 0:68.2.0-2.el8_0 | RHSA-2019:3196 | Oct 24, 2019 |
| firefox · Ubuntu 18.04.6 LTS (bionic) | 70.0+build2-0ubuntu0.18.04.1 | firefox 70.0+build2-0ubuntu0.18.04.1 | Jul 9, 2020 |
| firefox · Ubuntu 20.04 LTS (focal) | 70.0+build2-0ubuntu1 | firefox 70.0+build2-0ubuntu1 | Jul 9, 2020 |
| firefox · Ubuntu 24.10 (oracular) | 70.0+build2-0ubuntu1 | firefox 70.0+build2-0ubuntu1 | Sep 4, 2019 |
| firefox · Ubuntu 25.04 (plucky) | 70.0+build2-0ubuntu1 | firefox 70.0+build2-0ubuntu1 | Sep 4, 2019 |
| firefox-geckodriver · Ubuntu 18.04.6 LTS (bionic) | 70.0+build2-0ubuntu0.18.04.1 | firefox-geckodriver 70.0+build2-0ubuntu0.18.04.1 | Jul 9, 2020 |
| firefox-geckodriver · Ubuntu 20.04 LTS (focal) | 70.0+build2-0ubuntu1 | firefox-geckodriver 70.0+build2-0ubuntu1 | Jul 9, 2020 |
| firefox-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 70.0+build2-0ubuntu0.18.04.1 | firefox-mozsymbols 70.0+build2-0ubuntu0.18.04.1 | Jul 9, 2020 |
| firefox-mozsymbols · Ubuntu 20.04 LTS (focal) | 70.0+build2-0ubuntu1 | firefox-mozsymbols 70.0+build2-0ubuntu1 | Jul 9, 2020 |
| libexpat1 · Ubuntu 18.04.6 LTS (bionic) | 2.2.5-3ubuntu0.2 | libexpat1 2.2.5-3ubuntu0.2 | Sep 3, 2019 |
| libxmltok1 · Ubuntu 18.04.6 LTS (bionic) | 1.2-4ubuntu0.18.04.1~esm4 | libxmltok1 1.2-4ubuntu0.18.04.1~esm4 | Jan 10, 2022 |
| libxmltok1 · Ubuntu 20.04 LTS (focal) | 1.2-4ubuntu0.20.04.1~esm4 | libxmltok1 1.2-4ubuntu0.20.04.1~esm4 | Jan 10, 2022 |
| libxmltok1 · Ubuntu 22.04.1 LTS (jammy) | 1.2-4ubuntu0.22.04.1~esm4 | libxmltok1 1.2-4ubuntu0.22.04.1~esm4 | Jan 10, 2022 |
| libxmltok1t64 · Ubuntu 24.04.5 LTS (noble) | 1.2-4.1ubuntu2.24.0.4.1+esm2 | libxmltok1t64 1.2-4.1ubuntu2.24.0.4.1+esm2 | Jan 10, 2022 |
| libxmltok1t64 · Ubuntu 24.10 (oracular) | 1.2-4.1ubuntu3.1 | libxmltok1t64 1.2-4.1ubuntu3.1 | Sep 4, 2019 |
| thunderbird · RHEL 8 | 0:68.2.0-1.el8_0 | RHSA-2019:3237 | Oct 29, 2019 |
| thunderbird · Ubuntu 18.04.6 LTS (bionic) | 1:68.2.1+build1-0ubuntu0.18.04.1 | thunderbird 1:68.2.1+build1-0ubuntu0.18.04.1 | Oct 22, 2019 |
| thunderbird · Ubuntu 24.10 (oracular) | 1:68.2.0+build1.1-0ubuntu1 | thunderbird 1:68.2.0+build1.1-0ubuntu1 | Sep 4, 2019 |
| thunderbird · Ubuntu 25.04 (plucky) | 1:68.2.0+build1.1-0ubuntu1 | thunderbird 1:68.2.0+build1.1-0ubuntu1 | Sep 4, 2019 |
| thunderbird · ol 8 | 0:68.2.0-1.0.1.el8_0 | ELSA-2019-3237 | Oct 30, 2019 |
| thunderbird-gnome-support · Ubuntu 18.04.6 LTS (bionic) | 1:68.2.1+build1-0ubuntu0.18.04.1 | thunderbird-gnome-support 1:68.2.1+build1-0ubuntu0.18.04.1 | Oct 22, 2019 |
| thunderbird-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 1:68.2.1+build1-0ubuntu0.18.04.1 | thunderbird-mozsymbols 1:68.2.1+build1-0ubuntu0.18.04.1 | Oct 22, 2019 |
| xul-ext-calendar-timezones · Ubuntu 18.04.6 LTS (bionic) | 1:68.2.1+build1-0ubuntu0.18.04.1 | xul-ext-calendar-timezones 1:68.2.1+build1-0ubuntu0.18.04.1 | Oct 22, 2019 |
| xul-ext-gdata-provider · Ubuntu 18.04.6 LTS (bionic) | 1:68.2.1+build1-0ubuntu0.18.04.1 | xul-ext-gdata-provider 1:68.2.1+build1-0ubuntu0.18.04.1 | Oct 22, 2019 |
| xul-ext-lightning · Ubuntu 18.04.6 LTS (bionic) | 1:68.2.1+build1-0ubuntu0.18.04.1 | xul-ext-lightning 1:68.2.1+build1-0ubuntu0.18.04.1 | Oct 22, 2019 |
| No fix yet | |||
| Python 3.5 (Windows apps) | No fix yet | no-fix | n/a |
| Python 3.6 (Windows apps) | No fix yet | no-fix | n/a |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.