Most recent entries from all

ALSA-2024:6754 — Moderate: expat security update

Affected: AlmaLinux:9: expat, AlmaLinux:9: expat-devel

Expat is a C library for parsing XML documents.

Security Fix(es):

* libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490) * libexpat: Integer Overflow or Wraparound (CVE-2024-45491) * libexpat: integer overflow (CVE-2024-45492)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-07004

BELL-CVE-2024-45490

Affected: Alpaquita:23: expat, Alpaquita:stream: expat, BellSoft Hardened Containers:23: expat, BellSoft Hardened Containers:stream: expat

certfr-2024-avi-0958 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-0958

Withdrawn: CLEANSTART-2026-EM10970 — Security fixes for CVE-2017-9233, CVE-2019-15903, CVE-2021-45960, CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2…

Withdrawn by the publisher.

Affected: CleanStart: expat

Multiple security vulnerabilities affect the expat package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-336287

fkie_cve-2024-45490

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

GHSA-4hvh-m426-wv8w

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

ICSA-24-317-01 — Subnet Solutions PowerSYSTEM Center

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

msrc_CVE-2024-45490 — An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

msrc_CVE-2024-45490

OESA-2024-2102 — expat security update

Affected: openEuler:20.03-LTS-SP4: expat, openEuler:22.03-LTS-SP1: expat, openEuler:24.03-LTS: expat, openEuler:22.03-LTS-SP4: expat, openEuler:22.03-LTS-SP3: expat

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.(CVE-2024-45490)

openSUSE-SU-2024:14322-1 — expat-2.6.3-1.1 on GA media

expat-2.6.3-1.1 on GA media

RHSA-2024:10135 — Red Hat Security Advisory: Updated service-interconnect rhel9 container images for 1.4 LTS

curl: HTTP/2 push headers memory-leak openssl: Possible denial of service in X.509 name checks pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection glib2: Signal subscription vulnerabilities krb5: GSS message token handling krb5: GSS message token handling libexpat: Negative Length Parsing Vulnerability in libexpat libexpat: Integer Overflow or Wraparound libexpat: integer overflow

SSA-082556 — SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

Note: This SSA advises vulnerabilities for firmware version V3.1.5 only; for version V3.1.6 refer to SSA-019113.

SUSE-SU-2024:3182-1 — Security update for expat

Security update for expat

UBUNTU-CVE-2024-45490

Affected: Ubuntu:Pro:14.04:LTS: expat, Ubuntu:Pro:14.04:LTS: coin3, Ubuntu:Pro:14.04:LTS: vnc4, Ubuntu:Pro:14.04:LTS: vtk, Ubuntu:Pro:14.04:LTS: xmlrpc-c, Ubuntu:Pro:16.04:LTS: expat, Ubuntu:Pro:16.04:LTS: libxmltok, Ubuntu:Pro:16.04:LTS: ayttm, Ubuntu:Pro:16.04:LTS: cableswig, Ubuntu:16.04:LTS: cadaver and 62 more

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

WID-SEC-W-2024-1951 — expat: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in expat ausnutzen, um einen Denial of Service Angriff durchzuführen.