Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Exploitable Code in expat Library on Linux Systems
published 1 year ago
Summary
An update to the expat library is available to fix a critical security issue that could allow an attacker to execute code on your system. This update affects Linux systems and should be applied immediately to ensure the security of your system. Apply the update as soon as possible to prevent potential attacks.
What to do
- Update redhat expat to version 0:2.5.0-2.el9_4.
- Update redhat expat-debuginfo to version 0:2.5.0-2.el9_4.
- Update redhat expat-debugsource to version 0:2.5.0-2.el9_4.
- Update redhat expat-devel to version 0:2.5.0-2.el9_4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:9::appstream | redhat | expat |
< 0:2.5.0-2.el9_4 Fix: upgrade to 0:2.5.0-2.el9_4
|
| Red Hat:enterprise_linux:9::appstream | redhat | expat-debuginfo |
< 0:2.5.0-2.el9_4 Fix: upgrade to 0:2.5.0-2.el9_4
|
| Red Hat:enterprise_linux:9::appstream | redhat | expat-debugsource |
< 0:2.5.0-2.el9_4 Fix: upgrade to 0:2.5.0-2.el9_4
|
| Red Hat:enterprise_linux:9::appstream | redhat | expat-devel |
< 0:2.5.0-2.el9_4 Fix: upgrade to 0:2.5.0-2.el9_4
|
| Red Hat:enterprise_linux:9::baseos | redhat | expat |
< 0:2.5.0-2.el9_4 Fix: upgrade to 0:2.5.0-2.el9_4
|
| Red Hat:enterprise_linux:9::baseos | redhat | expat-debuginfo |
< 0:2.5.0-2.el9_4 Fix: upgrade to 0:2.5.0-2.el9_4
|
| Red Hat:enterprise_linux:9::baseos | redhat | expat-debugsource |
< 0:2.5.0-2.el9_4 Fix: upgrade to 0:2.5.0-2.el9_4
|
| Red Hat:enterprise_linux:9::baseos | redhat | expat-devel |
< 0:2.5.0-2.el9_4 Fix: upgrade to 0:2.5.0-2.el9_4
|
Original advisory text
Red Hat Bug Fix Advisory: expat bug fix and enhancement update
References
- https://access.redhat.com/errata/RHBA-2024:2518 Vendor Advisory
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.... Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_2518.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-28757 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2268766 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-28757 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-28757 Vendor Advisory
- https://github.com/libexpat/libexpat/issues/839 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published6 Jun 2025
Updated26 Mar 2026
First seen26 Mar 2026
Sources
RHBA-2024:2518 · OSV
Track software like this
Free during beta