USN-6694-1 — expat vulnerabilities

Summary

It was discovered that Expat could be made to consume large amounts of
resources. If a user or automated system were tricked into processing
specially crafted input, an attacker could possibly use this issue to cause
a denial of service. (CVE-2023-52425, CVE-2024-28757)

Fixed packages 1

Release	Package	Fixed in
Ubuntu · 22.04 LTS 22.04:LTS	expat	2.4.7-1ubuntu0.3

Vulnerabilities 2

High 7.5

CVE-2023-52425

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in t…

insighttoolkit4 expat matanza vtk Debian Ubuntu Azure Linux Alpine

Feb 4, 2024
High 7.5

CVE-2024-28757 Public exploit

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created vi…

insighttoolkit4 expat swish-e matanza Debian Ubuntu Azure Linux Alpine Wolfi

Mar 10, 2024

References

report
https://ubuntu.com/security/CVE-2023-52425
report
https://ubuntu.com/security/CVE-2024-28757

expat vulnerabilities

Summary

Fixed packages 1

Vulnerabilities 2

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in t…

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created vi…

References