Summary
Expat is a C library for parsing XML documents.
Security Fix(es):
* libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)
* libexpat: Integer Overflow or Wraparound (CVE-2024-45491)
* libexpat: integer overflow (CVE-2024-45492)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | expat | 2.2.5-15.el8_10 |
| AlmaLinux · 8 | expat-devel | 2.2.5-15.el8_10 |
Vulnerabilities 3
-
Critical 9.8CVE-2024-45490 Public exploit
An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.
-
High 7.3
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts o…
-
High 7.3
An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_gro…
References
-
report
https://access.redhat.com/security/cve/CVE-2024-45490
-
report
https://access.redhat.com/security/cve/CVE-2024-45491
-
report
https://access.redhat.com/security/cve/CVE-2024-45492
-
report
https://bugzilla.redhat.com/2308615
-
report
https://bugzilla.redhat.com/2308616
-
report
https://bugzilla.redhat.com/2308617
-
advisory
https://errata.almalinux.org/8/ALSA-2024-6989.html