ALAS2-2024-2710 — Important: expat security update (Amazon Linux 2)

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-45490: An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

Fixed packages 4

Release	Package	Fixed in
Amazon Linux · 2	expat	0:2.1.0-15.amzn2.0.4
Amazon Linux · 2	expat-debuginfo	0:2.1.0-15.amzn2.0.4
Amazon Linux · 2	expat-devel	0:2.1.0-15.amzn2.0.4
Amazon Linux · 2	expat-static	0:2.1.0-15.amzn2.0.4

Vulnerabilities 1

Critical 9.8

CVE-2024-45490 Public exploit

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

qt6-qtwebengine qt5-qtwebengine insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine Wolfi

Aug 30, 2024

References

web
https://alas.aws.amazon.com/cve/html/CVE-2024-45490.html