CVE-2024-28757

2024-03-1005:15:06

Debian Security Bug Tracker

security-tracker.debian.org

libexpat

xml entity expansion

attack

external parsers

unix

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.1%

JSON

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

OSVersionArchitecturePackageVersionFilename
Debian12allexpat<= 2.5.0-1expat_2.5.0-1_all.deb
Debian11allexpat<= 2.2.10-2+deb11u5expat_2.2.10-2+deb11u5_all.deb
Debian10allexpat<= 2.2.6-2+deb10u4expat_2.2.6-2+deb10u4_all.deb
Debian999allexpat< 2.6.1-2expat_2.6.1-2_all.deb
Debian13allexpat< 2.6.1-2expat_2.6.1-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	expat	<= 2.5.0-1	expat_2.5.0-1_all.deb
Debian	11	all	expat	<= 2.2.10-2+deb11u5	expat_2.2.10-2+deb11u5_all.deb
Debian	10	all	expat	<= 2.2.6-2+deb10u4	expat_2.2.6-2+deb10u4_all.deb
Debian	999	all	expat	< 2.6.1-2	expat_2.6.1-2_all.deb
Debian	13	all	expat	< 2.6.1-2	expat_2.6.1-2_all.deb