Medium ALSA-2024:1530 2 CVEs

Moderate: expat security update

Published Mar 26, 2024 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Expat is a C library for parsing XML documents.

Security Fix(es):

* expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)
* expat: XML Entity Expansion (CVE-2024-28757)

Fixed packages 2

Release	Package	Fixed in
AlmaLinux · 9	expat	2.5.0-1.el9_3.1
AlmaLinux · 9	expat-devel	2.5.0-1.el9_3.1

Vulnerabilities 2

High 7.5

CVE-2023-52425

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in t…

insighttoolkit4 expat matanza vtk Debian Ubuntu Azure Linux Alpine

Feb 4, 2024
High 7.5

CVE-2024-28757 Public exploit

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created vi…

insighttoolkit4 expat swish-e matanza Debian Ubuntu Azure Linux Alpine Wolfi

Mar 10, 2024

References

report
https://access.redhat.com/security/cve/CVE-2023-52425
report
https://access.redhat.com/security/cve/CVE-2024-28757
report
https://bugzilla.redhat.com/2262877
report
https://bugzilla.redhat.com/2268766
advisory
https://errata.almalinux.org/9/ALSA-2024-1530.html