Summary
Shang-Hung Wan discovered that Expat did not properly handle certain
function calls when a negative input length was provided. An attacker
could use this issue to cause a denial of service or possibly execute
arbitrary code. (CVE-2024-45490)
Shang-Hung Wan discovered that Expat did not properly handle the
potential for an integer overflow on 32-bit platforms. An attacker
could use this issue to cause a denial of service or possibly execute
arbitrary code. (CVE-2024-45491, CVE-2024-45492)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | expat | 2.2.9-1ubuntu0.7 |
| Ubuntu · 24.04 LTS 24.04:LTS | expat | 2.6.1-2ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | expat | 2.1.0-4ubuntu1.4+esm9 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | expat | 2.1.0-7ubuntu0.16.04.5+esm9 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | expat | 2.2.5-3ubuntu0.9+esm1 |
Vulnerabilities 3
-
Critical 9.8CVE-2024-45490 Public exploit
An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.
-
High 7.3
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts o…
-
High 7.3
An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_gro…