Medium ELSA-2025-4048 1 CVE

Moderate: xmlrpc-c security update (Oracle Linux 8)

Published Apr 21, 2025 · Updated Apr 21, 2025

Ecosystem: Oracle Linux

Summary

[1.51.0-11]
- Restrict XML Entity Expansion Depth in libexpat CVE-2024-8176

Fixed packages 5

Release	Package	Fixed in
Oracle Linux · 8	xmlrpc-c	0:1.51.0-11.el8_10
Oracle Linux · 8	xmlrpc-c-c++	0:1.51.0-11.el8_10
Oracle Linux · 8	xmlrpc-c-client	0:1.51.0-11.el8_10
Oracle Linux · 8	xmlrpc-c-client++	0:1.51.0-11.el8_10
Oracle Linux · 8	xmlrpc-c-devel	0:1.51.0-11.el8_10

Vulnerabilities 1

High 7.5

CVE-2024-8176 Public exploit

Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting …

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi

Mar 14, 2025