Fedora 39 : mingw-expat (2024-4e6e660fae)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-4e6e660fae advisory. Update to 2.6.1, backport fix for CVE-2024-28757. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 38 : mingw-expat (2024-40b98c9ced)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-40b98c9ced advisory. Update to 2.6.1, backport fix for CVE-2024-28757. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Ubuntu 22.04 LTS / 23.10 : Expat vulnerabilities (USN-6694-1)

The remote Ubuntu 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6694-1 advisory. It was discovered that Expat could be made to consume large amounts of resources. If a user or automated system were tricked into processing...

Slackware Linux 15.0 / current expat Vulnerability (SSA:2024-073-01)

The version of expat installed on the remote host is prior to 2.6.2. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-073-01 advisory. - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via...

XML Entity Expansion

libexpat is vulnerable to XML Entity Expansion. The vulnerability is caused due to insufficient input validation and handling of external entities in the XML parser. This allows an attacker to perform an XML Entity Expansion attack...

CVE-2024-28757

An XML Entity Expansion flaw was found in libexpat. This flaw allows an attacker to cause a denial of service when there is an isolated use of external parsers...

DEBIAN-CVE-2024-28757

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...

CVE-2024-28757

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...

ALPINE-CVE-2024-28757

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...

AZL-35880 CVE-2024-28757 affecting package expat for versions less than 2.6.2-1

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...

CVE-2024-28757

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...

CVE-2024-28757

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...

CVE-2024-28757: Improper Restriction of Recursive Entity References in DTDs

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...

CVE-2024-28757

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...

CVE-2024-28757

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers created via XMLExternalEntityParserCreate...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2024-524)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-524 advisory. libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time. CVE-2023-52426 Tenable has extracted the preceding description block directly from the tested product...

Medium: expat

Issue Overview: libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time. CVE-2023-52426 Affected Packages: expat Issue Correction: Run dnf update expat --releasever 2023.3.20240219 to update your system. New Packages: aarch64: ...

Medium: expat

Issue Overview: libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time. CVE-2023-52426 Affected Packages: expat Issue Correction: Run dnf update expat --releasever 2023.3.20240219 or dnf update --advisory ALAS2023-2024-524 --releasever 2023.3.20240219 ...

CentOS 8 : libxml2 (CESA-2023:0173)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:0173 advisory. - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, several...

Slackware Linux 15.0 / current expat Multiple Vulnerabilities (SSA:2024-038-01)

The version of expat installed on the remote host is prior to 2.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-038-01 advisory. - libexpat through 2.5.0 allows a denial of service resource consumption because many full reparsings are required in the case...