ELSA-2024-1530 — Moderate: expat security update (Oracle Linux 9)

Summary

[2.5.0-1.1]
- CVE-2023-52425: Fix parsing of large tokens
- CVE-2024-28757: Reject direct parameter entity recursion
- Resolves: RHEL-29698
- Resolves: RHEL-29695

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 9	expat	0:2.5.0-1.el9_3.1
Oracle Linux · 9	expat-devel	0:2.5.0-1.el9_3.1

Vulnerabilities 2

High 7.5

CVE-2023-52425

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in t…

insighttoolkit4 expat matanza vtk Debian Ubuntu Azure Linux Alpine

Feb 4, 2024
High 7.5

CVE-2024-28757 Public exploit

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created vi…

insighttoolkit4 expat swish-e matanza Debian Ubuntu Azure Linux Alpine Wolfi

Mar 10, 2024

Moderate: expat security update (Oracle Linux 9)

Summary

Fixed packages 2

Vulnerabilities 2

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in t…

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created vi…