ALAS2023-2024-524 — Moderate: expat security update (Amazon Linux 2023)

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-52426: libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

Fixed packages 5

Release	Package	Fixed in
Amazon Linux · 2023	expat	0:2.5.0-1.amzn2023.0.3
Amazon Linux · 2023	expat-debuginfo	0:2.5.0-1.amzn2023.0.3
Amazon Linux · 2023	expat-debugsource	0:2.5.0-1.amzn2023.0.3
Amazon Linux · 2023	expat-devel	0:2.5.0-1.amzn2023.0.3
Amazon Linux · 2023	expat-static	0:2.5.0-1.amzn2023.0.3

Vulnerabilities 1

Medium 5.5

CVE-2023-52426

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

insighttoolkit4 expat swish-e vtk Debian Ubuntu Azure Linux Alpine

Feb 4, 2024

References

web
https://alas.aws.amazon.com/cve/html/CVE-2023-52426.html