Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Expat XML parser can be manipulated to crash
published 2 years ago
Summary
The Expat library used in Red Hat systems may allow specially crafted XML data to cause the program to stop working or behave incorrectly. This could affect any application that relies on Expat for processing XML, potentially leading to service interruptions. Update the Expat packages to the latest versions provided by Red Hat to resolve the issue.
What to do
- Update redhat expat to version 0:2.2.5-8.el8_6.5.
- Update redhat expat-debuginfo to version 0:2.2.5-8.el8_6.5.
- Update redhat expat-debugsource to version 0:2.2.5-8.el8_6.5.
- Update redhat expat-devel to version 0:2.2.5-8.el8_6.5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhel_eus:8.6::baseos | redhat | expat |
< 0:2.2.5-8.el8_6.5 Fix: upgrade to 0:2.2.5-8.el8_6.5
|
| Red Hat:rhel_eus:8.6::baseos | redhat | expat-debuginfo |
< 0:2.2.5-8.el8_6.5 Fix: upgrade to 0:2.2.5-8.el8_6.5
|
| Red Hat:rhel_eus:8.6::baseos | redhat | expat-debugsource |
< 0:2.2.5-8.el8_6.5 Fix: upgrade to 0:2.2.5-8.el8_6.5
|
| Red Hat:rhel_eus:8.6::baseos | redhat | expat-devel |
< 0:2.2.5-8.el8_6.5 Fix: upgrade to 0:2.2.5-8.el8_6.5
|
Original advisory text
Red Hat Security Advisory: expat security update
References
- https://access.redhat.com/errata/RHSA-2024:2839 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2262877 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2839.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-52425 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-52425 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-52425 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published16 Sep 2024
Updated17 Sep 2026
First seen17 Sep 2026
Sources
RHSA-2024:2839 · OSV
Track software like this
Free during beta