ELSA-2024-6754 — Moderate: expat security update (Oracle Linux 9)

Summary

[2.5.0-2.1]
- Fix multiple CVEs
- Fix CVE-2024-45492 integer overflow
- Fix CVE-2024-45491 Integer Overflow or Wraparound
- Fix CVE-2024-45490 Negative Length Parsing Vulnerability
- Resolves: RHEL-57510
- Resolves: RHEL-57497
- Resolves: RHEL-56763

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 9	expat	0:2.5.0-2.el9_4.1
Oracle Linux · 9	expat-devel	0:2.5.0-2.el9_4.1

Vulnerabilities 3

Critical 9.8

CVE-2024-45490 Public exploit

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

qt6-qtwebengine qt5-qtwebengine insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine Wolfi

Aug 30, 2024
High 7.3

CVE-2024-45491

An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts o…

qt6-qtwebengine qt5-qtwebengine insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine Wolfi

Aug 30, 2024
High 7.3

CVE-2024-45492

An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_gro…

qt6-qtwebengine qt5-qtwebengine insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine Wolfi

Aug 30, 2024

Moderate: expat security update (Oracle Linux 9)

Summary

Fixed packages 2

Vulnerabilities 3

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts o…

An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_gro…