Summary
It was discovered that Expat could crash due to stack overflow when
processing XML documents with deeply nested entity references. If a user
or automated system were tricked into processing specially crafted XML
input, an attacker could use this issue to cause a denial of service.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | expat | 2.4.7-1ubuntu0.6 |
| Ubuntu · 24.04 LTS 24.04:LTS | expat | 2.6.1-2ubuntu0.3 |
Vulnerabilities 1
-
High 7.5CVE-2024-8176 Public exploit
Libexpat: expat: improper restriction of xml entity expansion depth in libexpat
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting …
References
-
report
https://ubuntu.com/security/CVE-2024-8176