Fedora 39 : mingw-expat (2024-fbe1f0c1aa)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-fbe1f0c1aa advisory. Update to 2.6.0, fixes CVE-2023-52425, CVE-2023-52426. Tenable has extracted the preceding description block directly from the Fedora security...

OESA-2024-1183 libxml2 security update

Library providing XML and HTML support. Security Fixes: An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement...

CLSA-2024-1708639232 libxml2: Fix of CVE-2024-25062

CVE-2024-25062: Fix xmlValidatePopElement use-after-free in XML Reader interface with DTD validation and XInclude expansion enabled - test suite was partially activated...

libxml2: Fix of CVE-2024-25062

CVE-2024-25062: Fix xmlValidatePopElement use-after-free in XML Reader interface with DTD validation and XInclude expansion enabled - test suite was partially activated...

CLSA-2024-1708639015 libxml2: Fix of CVE-2024-25062

CVE-2024-25062: Fix xmlValidatePopElement use-after-free when processing crafted XML documents with DTD validation and XInclude expansion enabled - test suite was partially enabled...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the lineswithleadingtabsexpanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this...

CLSA-2024-1708427829 Fix CVE(s): CVE-2024-25062

SECURITY UPDATE: Use-after-free in xmlValidatePopElement - debian/patches/CVE-2024-25062.patch: Fix use-after-free if XML Reader with DTD validation and XInclude expansion by not expanding XIncludes when backtracking - CVE-2024-25062...

CLSA-2024-1708427636 Fix CVE(s): CVE-2024-25062

SECURITY UPDATE: Use-after-free in xmlValidatePopElement - debian/patches/CVE-2024-25062.patch: Fix use-after-free if XML Reader when used with DTD validation and XInclude expansion - CVE-2024-25062...

CLSA-2024-1708416911 libxml2: Fix of CVE-2024-25062

CVE-2024-25062: Fix use-after-free issue in libxml2 XML Reader interface with DTD validation and XInclude expansion enabled...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2024-524)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-524 advisory. libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time. CVE-2023-52426 Tenable has extracted the preceding description block directly from the tested product...

Medium: expat

Issue Overview: libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time. CVE-2023-52426 Affected Packages: expat Issue Correction: Run dnf update expat --releasever 2023.3.20240219 or dnf update --advisory ALAS2023-2024-524 --releasever 2023.3.20240219 ...

Medium: expat

Issue Overview: libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time. CVE-2023-52426 Affected Packages: expat Issue Correction: Run dnf update expat --releasever 2023.3.20240219 to update your system. New Packages: aarch64: ...

CVE-2024-24743

SAP NetWeaver AS Java CAF - Guided Procedures - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so...

Design/Logic Flaw

SAP NetWeaver AS Java CAF - Guided Procedures - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so...

CVE-2024-24743 XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)

SAP NetWeaver AS Java CAF - Guided Procedures - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so...

CVE-2024-24743 XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)

SAP NetWeaver AS Java CAF - Guided Procedures - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them. There are expansion limits in place so...

XML Entity Expansion

libexpat is vulnerable to XML Entity Expansion . the vulnerability is due to Improper Restriction of Recursive Entity References in DTDs if XMLDTD is undefined at compile time...

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

...

GLSA-202402-11 : libxml2: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202402-11 libxml2: Multiple Vulnerabilities - In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault. This occurs in xmlSchemaFixupComplexType in...

Slackware Linux 15.0 / current expat Multiple Vulnerabilities (SSA:2024-038-01)

The version of expat installed on the remote host is prior to 2.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-038-01 advisory. - libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case...