This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Expat fixes 3 vulnerabilities
Expat, an XML parser used in a large number of distributions (Debian, Ubuntu, Arch, Gentoo, CentOS, etc. [1]) and software (Firefox, Chromium, LibreOffice, Thunderbird, Unbound, etc. [2]), fixes 3 vulnerabilities in version 2.6.3 [3][4][5]. Of the operating systems, the vulnerabilities have so far been fixed by Slackware [6]; Gentoo has released a fix for the most commonly used architectures [7], and Debian has so far released a fix only for the unstable and testing releases [8].
An unauthenticated remote attacker can, by using specially crafted input, cause a DoS attack or unauthorized code execution [3][9].
The vulnerability is present in product:
- Expat; <2.6.3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-45490 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 29. 8. 2024.
An unauthenticated remote attacker can, by using specially crafted input, cause a DoS attack or unauthorized code execution [4][10][5][11].
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-45491 at cve.org, NVD
- CVE-2024-45492 at cve.org, NVD
- CWE-190: Integer Overflow or Wraparound at cwe.mitre.org
The vulnerability was publicly disclosed 29. 8. 2024.
Links
- [1] https://libexpat.github.io/doc/packages/
- [2] https://libexpat.github.io/doc/users/
- [3] https://nvd.nist.gov/vuln/detail/CVE-2024-45490
- [4] https://nvd.nist.gov/vuln/detail/CVE-2024-45491
- [5] https://nvd.nist.gov/vuln/detail/CVE-2024-45492
- [6] http://www.slackware.com/security/viewer.php?l=slackware-security&y=2024&m=slackware-security.351556
- [7] https://packages.gentoo.org/packages/dev-libs/expat
- [8] https://security-tracker.debian.org/tracker/source-package/expat
- [9] https://github.com/libexpat/libexpat/issues/887
- [10] https://github.com/libexpat/libexpat/issues/888
- [11] https://github.com/libexpat/libexpat/issues/889
By CESNET, z.s.p.o. Martin Krajči on 5. 9. 2024.