suse-su-2025:20207-1
Vulnerability from csaf_suse
Published
2025-04-29 11:07
Modified
2025-04-29 11:07
Summary
Security update for expat
Notes
Title of the patch
Security update for expat
Description of the patch
This update for expat fixes the following issues:
Version update to 2.7.1:
* Bug fixes:
* Restore event pointer behavior from Expat 2.6.4 (that the fix to CVE-2024-8176 changed in 2.7.0);
affected API functions are:
- XML_GetCurrentByteCount
- XML_GetCurrentByteIndex
- XML_GetCurrentColumnNumber
- XML_GetCurrentLineNumber
- XML_GetInputContext
* Other changes:
#976 #977 Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
with Automake that were missing from 2.7.0 release tarballs
#983 #984 Fix printf format specifiers for 32bit Emscripten
#992 docs: Promote OpenSSF Best Practices self-certification
#978 tests/benchmark: Resolve mistaken double close
#986 Address compiler warnings
#990 #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
for what these numbers do
Infrastructure:
#982 CI: Start running Perl XML::Parser integration tests
#987 CI: Enforce Clang Static Analyzer clean code
#991 CI: Re-enable warning clang-analyzer-valist.Uninitialized
for clang-tidy
#981 CI: Cover compilation with musl
#983 #984 CI: Cover compilation with 32bit Emscripten
#976 #977 CI: Protect against fuzzer files missing from future
release archives
Version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
* Security fixes:
* CVE-2024-8176 -- Fix crash from chaining a large number
of entities caused by stack overflow by resolving use of
recursion, for all three uses of entities:
- general entities in character data ("<e>&g1;</e>")
- general entities in attribute values ("<e k1='&g1;'/>")
- parameter entities ("%p1;")
Known impact is (reliable and easy) denial of service:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
(Base Score: 7.5, Temporal Score: 7.2)
Please note that a layer of compression around XML can
significantly reduce the minimum attack payload size.
* Other changes:
* Document changes since the previous release
* Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
for what these numbers do
Version update to 2.6.4:
* Security fixes: [bsc#1232601][bsc#1232579]
* CVE-2024-50602 -- Fix crash within function XML_ResumeParser
from a NULL pointer dereference by disallowing function
XML_StopParser to (stop or) suspend an unstarted parser.
A new error code XML_ERROR_NOT_STARTED was introduced to
properly communicate this situation. // CWE-476 CWE-754
* Other changes:
* Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
for what these numbers do
Update to 2.6.3:
* Security fixes:
- CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
len < 0 without noticing and then calling XML_GetBuffer
will have XML_ParseBuffer fail to recognize the problem
and XML_GetBuffer corrupt memory.
With the fix, XML_ParseBuffer now complains with error
XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
has been doing since Expat 2.2.1, and now documented.
Impact is denial of service to potentially artitrary code
execution.
- CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
integer overflow for nDefaultAtts on 32-bit platforms
(where UINT_MAX equals SIZE_MAX).
Impact is denial of service to potentially artitrary code
execution.
- CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
have an integer overflow for m_groupSize on 32-bit
platforms (where UINT_MAX equals SIZE_MAX).
Impact is denial of service to potentially artitrary code
execution.
* Other changes:
- Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
for what these numbers do
Update to 2.6.2:
* CVE-2024-28757 -- Prevent billion laughs attacks with isolated
use of external parsers (bsc#1221289)
* Reject direct parameter entity recursion and avoid the related
undefined behavior
Update to 2.6.1:
* Expose billion laughs API with XML_DTD defined and XML_GE
undefined, regression from 2.6.0
* Make tests independent of CPU speed, and thus more robust
Update to 2.6.0:
* Security fixes:
- CVE-2023-52425 (bsc#1219559)
Fix quadratic runtime issues with big tokens
that can cause denial of service, in partial where
dealing with compressed XML input. Applications
that parsed a document in one go -- a single call to
functions XML_Parse or XML_ParseBuffer -- were not affected.
The smaller the chunks/buffers you use for parsing
previously, the bigger the problem prior to the fix.
Backporters should be careful to no omit parts of
pull request #789 and to include earlier pull request #771,
in order to not break the fix.
- CVE-2023-52426 (bsc#1219561)
Fix billion laughs attacks for users
compiling *without* XML_DTD defined (which is not common).
Users with XML_DTD defined have been protected since
Expat >=2.4.0 (and that was CVE-2013-0340 back then).
* Bug fixes:
- Fix parse-size-dependent "invalid token" error for
external entities that start with a byte order mark
- Fix NULL pointer dereference in setContext via
XML_ExternalEntityParserCreate for compilation with
XML_DTD undefined
- Protect against closing entities out of order
* Other changes:
- Improve support for arc4random/arc4random_buf
- Improve buffer growth in XML_GetBuffer and XML_Parse
- xmlwf: Support --help and --version
- xmlwf: Support custom buffer size for XML_GetBuffer and read
- xmlwf: Improve language and URL clickability in help output
- examples: Add new example "element_declarations.c"
- Be stricter about macro XML_CONTEXT_BYTES at build time
- Make inclusion to expat_config.h consistent
- Autotools: configure.ac: Support --disable-maintainer-mode
- Autotools: Sync CMake templates with CMake 3.26
- Autotools: Make installation of shipped man page doc/xmlwf.1
independent of docbook2man availability
- Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
section "Cflags.private" in order to fix compilation
against static libexpat using pkg-config on Windows
- Autotools|CMake: Require a C99 compiler
(a de-facto requirement already since Expat 2.2.2 of 2017)
- Autotools|CMake: Fix PACKAGE_BUGREPORT variable
- Autotools|CMake: Make test suite require a C++11 compiler
- CMake: Require CMake >=3.5.0
- CMake: Lowercase off_t and size_t to help a bug in Meson
- CMake: Sort xmlwf sources alphabetically
- CMake|Windows: Fix generation of DLL file version info
- CMake: Build tests/benchmark/benchmark.c as well for
a build with -DEXPAT_BUILD_TESTS=ON
- docs: Document the importance of isFinal + adjust tests
accordingly
- docs: Improve use of "NULL" and "null"
- docs: Be specific about version of XML (XML 1.0r4)
and version of C (C99); (XML 1.0r5 will need a sponsor.)
- docs: reference.html: Promote function XML_ParseBuffer more
- docs: reference.html: Add HTML anchors to XML_* macros
- docs: reference.html: Upgrade to OK.css 1.2.0
- docs: Fix typos
- docs|CI: Use HTTPS URLs instead of HTTP at various places
- Address compiler warnings
- Address clang-tidy warnings
- Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
for what these numbers do
Patchnames
SUSE-SLE-Micro-6.0-304
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for expat",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for expat fixes the following issues:\n\nVersion update to 2.7.1:\n\n* Bug fixes:\n\n * Restore event pointer behavior from Expat 2.6.4 (that the fix to CVE-2024-8176 changed in 2.7.0);\n affected API functions are:\n\n - XML_GetCurrentByteCount\n - XML_GetCurrentByteIndex\n - XML_GetCurrentColumnNumber\n - XML_GetCurrentLineNumber\n - XML_GetInputContext\n\n * Other changes:\n #976 #977 Autotools: Integrate files \"fuzz/xml_lpm_fuzzer.{cpp,proto}\"\n with Automake that were missing from 2.7.0 release tarballs\n #983 #984 Fix printf format specifiers for 32bit Emscripten\n #992 docs: Promote OpenSSF Best Practices self-certification\n #978 tests/benchmark: Resolve mistaken double close\n #986 Address compiler warnings\n #990 #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1)\n to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/\n for what these numbers do\n\n Infrastructure:\n #982 CI: Start running Perl XML::Parser integration tests\n #987 CI: Enforce Clang Static Analyzer clean code\n #991 CI: Re-enable warning clang-analyzer-valist.Uninitialized\n for clang-tidy\n #981 CI: Cover compilation with musl\n #983 #984 CI: Cover compilation with 32bit Emscripten\n #976 #977 CI: Protect against fuzzer files missing from future\n release archives\n\nVersion update to 2.7.0 (CVE-2024-8176 [bsc#1239618])\n\n* Security fixes:\n * CVE-2024-8176 -- Fix crash from chaining a large number\n of entities caused by stack overflow by resolving use of\n recursion, for all three uses of entities:\n - general entities in character data (\"\u003ce\u003e\u0026g1;\u003c/e\u003e\")\n - general entities in attribute values (\"\u003ce k1=\u0027\u0026g1;\u0027/\u003e\")\n - parameter entities (\"%p1;\")\n\n Known impact is (reliable and easy) denial of service:\n\n CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C\n\n (Base Score: 7.5, Temporal Score: 7.2)\n\n Please note that a layer of compression around XML can\n significantly reduce the minimum attack payload size.\n\n * Other changes:\n * Document changes since the previous release\n * Version info bumped from 11:0:10 (libexpat*.so.1.10.0)\n to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/\n for what these numbers do\n\nVersion update to 2.6.4:\n\n * Security fixes: [bsc#1232601][bsc#1232579]\n * CVE-2024-50602 -- Fix crash within function XML_ResumeParser\n from a NULL pointer dereference by disallowing function\n XML_StopParser to (stop or) suspend an unstarted parser.\n A new error code XML_ERROR_NOT_STARTED was introduced to\n properly communicate this situation. // CWE-476 CWE-754\n * Other changes:\n * Version info bumped from 10:3:9 (libexpat*.so.1.9.3)\n to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/\n for what these numbers do\n\nUpdate to 2.6.3:\n\n * Security fixes:\n - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with\n len \u003c 0 without noticing and then calling XML_GetBuffer\n will have XML_ParseBuffer fail to recognize the problem\n and XML_GetBuffer corrupt memory.\n With the fix, XML_ParseBuffer now complains with error\n XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse\n has been doing since Expat 2.2.1, and now documented.\n Impact is denial of service to potentially artitrary code\n execution.\n - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an\n integer overflow for nDefaultAtts on 32-bit platforms\n (where UINT_MAX equals SIZE_MAX).\n Impact is denial of service to potentially artitrary code\n execution.\n - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can\n have an integer overflow for m_groupSize on 32-bit\n platforms (where UINT_MAX equals SIZE_MAX).\n Impact is denial of service to potentially artitrary code\n execution.\n\n * Other changes:\n\n - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)\n to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/\n for what these numbers do \n\nUpdate to 2.6.2:\n\n * CVE-2024-28757 -- Prevent billion laughs attacks with isolated\n use of external parsers (bsc#1221289)\n * Reject direct parameter entity recursion and avoid the related\n undefined behavior\n\nUpdate to 2.6.1:\n\n * Expose billion laughs API with XML_DTD defined and XML_GE\n undefined, regression from 2.6.0\n * Make tests independent of CPU speed, and thus more robust\n\nUpdate to 2.6.0: \n\n * Security fixes:\n - CVE-2023-52425 (bsc#1219559) \n Fix quadratic runtime issues with big tokens\n that can cause denial of service, in partial where\n dealing with compressed XML input. Applications\n that parsed a document in one go -- a single call to\n functions XML_Parse or XML_ParseBuffer -- were not affected.\n The smaller the chunks/buffers you use for parsing\n previously, the bigger the problem prior to the fix.\n Backporters should be careful to no omit parts of\n pull request #789 and to include earlier pull request #771,\n in order to not break the fix.\n - CVE-2023-52426 (bsc#1219561)\n Fix billion laughs attacks for users\n compiling *without* XML_DTD defined (which is not common).\n Users with XML_DTD defined have been protected since\n Expat \u003e=2.4.0 (and that was CVE-2013-0340 back then).\n * Bug fixes:\n - Fix parse-size-dependent \"invalid token\" error for\n external entities that start with a byte order mark\n - Fix NULL pointer dereference in setContext via\n XML_ExternalEntityParserCreate for compilation with\n XML_DTD undefined\n - Protect against closing entities out of order\n * Other changes:\n - Improve support for arc4random/arc4random_buf\n - Improve buffer growth in XML_GetBuffer and XML_Parse\n - xmlwf: Support --help and --version\n - xmlwf: Support custom buffer size for XML_GetBuffer and read\n - xmlwf: Improve language and URL clickability in help output\n - examples: Add new example \"element_declarations.c\"\n - Be stricter about macro XML_CONTEXT_BYTES at build time\n - Make inclusion to expat_config.h consistent\n - Autotools: configure.ac: Support --disable-maintainer-mode\n - Autotools: Sync CMake templates with CMake 3.26\n - Autotools: Make installation of shipped man page doc/xmlwf.1\n independent of docbook2man availability\n - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file\n section \"Cflags.private\" in order to fix compilation\n against static libexpat using pkg-config on Windows\n - Autotools|CMake: Require a C99 compiler\n (a de-facto requirement already since Expat 2.2.2 of 2017)\n - Autotools|CMake: Fix PACKAGE_BUGREPORT variable\n - Autotools|CMake: Make test suite require a C++11 compiler\n - CMake: Require CMake \u003e=3.5.0\n - CMake: Lowercase off_t and size_t to help a bug in Meson\n - CMake: Sort xmlwf sources alphabetically\n - CMake|Windows: Fix generation of DLL file version info\n - CMake: Build tests/benchmark/benchmark.c as well for\n a build with -DEXPAT_BUILD_TESTS=ON\n - docs: Document the importance of isFinal + adjust tests\n accordingly\n - docs: Improve use of \"NULL\" and \"null\"\n - docs: Be specific about version of XML (XML 1.0r4)\n and version of C (C99); (XML 1.0r5 will need a sponsor.)\n - docs: reference.html: Promote function XML_ParseBuffer more\n - docs: reference.html: Add HTML anchors to XML_* macros\n - docs: reference.html: Upgrade to OK.css 1.2.0\n - docs: Fix typos\n - docs|CI: Use HTTPS URLs instead of HTTP at various places\n - Address compiler warnings\n - Address clang-tidy warnings\n - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)\n to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/\n for what these numbers do\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-304",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20207-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:20207-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520207-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:20207-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-June/021128.html"
},
{
"category": "self",
"summary": "SUSE Bug 1219559",
"url": "https://bugzilla.suse.com/1219559"
},
{
"category": "self",
"summary": "SUSE Bug 1219561",
"url": "https://bugzilla.suse.com/1219561"
},
{
"category": "self",
"summary": "SUSE Bug 1221289",
"url": "https://bugzilla.suse.com/1221289"
},
{
"category": "self",
"summary": "SUSE Bug 1229930",
"url": "https://bugzilla.suse.com/1229930"
},
{
"category": "self",
"summary": "SUSE Bug 1229931",
"url": "https://bugzilla.suse.com/1229931"
},
{
"category": "self",
"summary": "SUSE Bug 1229932",
"url": "https://bugzilla.suse.com/1229932"
},
{
"category": "self",
"summary": "SUSE Bug 1232579",
"url": "https://bugzilla.suse.com/1232579"
},
{
"category": "self",
"summary": "SUSE Bug 1232601",
"url": "https://bugzilla.suse.com/1232601"
},
{
"category": "self",
"summary": "SUSE Bug 1239618",
"url": "https://bugzilla.suse.com/1239618"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2013-0340 page",
"url": "https://www.suse.com/security/cve/CVE-2013-0340/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-15903 page",
"url": "https://www.suse.com/security/cve/CVE-2019-15903/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-52425 page",
"url": "https://www.suse.com/security/cve/CVE-2023-52425/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-52426 page",
"url": "https://www.suse.com/security/cve/CVE-2023-52426/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-28757 page",
"url": "https://www.suse.com/security/cve/CVE-2024-28757/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45490 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45490/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45491 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45491/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45492 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45492/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-50602 page",
"url": "https://www.suse.com/security/cve/CVE-2024-50602/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-8176 page",
"url": "https://www.suse.com/security/cve/CVE-2024-8176/"
}
],
"title": "Security update for expat",
"tracking": {
"current_release_date": "2025-04-29T11:07:45Z",
"generator": {
"date": "2025-04-29T11:07:45Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:20207-1",
"initial_release_date": "2025-04-29T11:07:45Z",
"revision_history": [
{
"date": "2025-04-29T11:07:45Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "libexpat1-2.7.1-1.1.aarch64",
"product": {
"name": "libexpat1-2.7.1-1.1.aarch64",
"product_id": "libexpat1-2.7.1-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libexpat1-2.7.1-1.1.s390x",
"product": {
"name": "libexpat1-2.7.1-1.1.s390x",
"product_id": "libexpat1-2.7.1-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libexpat1-2.7.1-1.1.x86_64",
"product": {
"name": "libexpat1-2.7.1-1.1.x86_64",
"product_id": "libexpat1-2.7.1-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libexpat1-2.7.1-1.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64"
},
"product_reference": "libexpat1-2.7.1-1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexpat1-2.7.1-1.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x"
},
"product_reference": "libexpat1-2.7.1-1.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libexpat1-2.7.1-1.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
},
"product_reference": "libexpat1-2.7.1-1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2013-0340",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2013-0340"
}
],
"notes": [
{
"category": "general",
"text": "expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2013-0340",
"url": "https://www.suse.com/security/cve/CVE-2013-0340"
},
{
"category": "external",
"summary": "SUSE Bug 805236 for CVE-2013-0340",
"url": "https://bugzilla.suse.com/805236"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-04-29T11:07:45Z",
"details": "moderate"
}
],
"title": "CVE-2013-0340"
},
{
"cve": "CVE-2019-15903",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-15903"
}
],
"notes": [
{
"category": "general",
"text": "In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-15903",
"url": "https://www.suse.com/security/cve/CVE-2019-15903"
},
{
"category": "external",
"summary": "SUSE Bug 1149429 for CVE-2019-15903",
"url": "https://bugzilla.suse.com/1149429"
},
{
"category": "external",
"summary": "SUSE Bug 1154738 for CVE-2019-15903",
"url": "https://bugzilla.suse.com/1154738"
},
{
"category": "external",
"summary": "SUSE Bug 1154806 for CVE-2019-15903",
"url": "https://bugzilla.suse.com/1154806"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-04-29T11:07:45Z",
"details": "important"
}
],
"title": "CVE-2019-15903"
},
{
"cve": "CVE-2023-52425",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-52425"
}
],
"notes": [
{
"category": "general",
"text": "libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-52425",
"url": "https://www.suse.com/security/cve/CVE-2023-52425"
},
{
"category": "external",
"summary": "SUSE Bug 1219559 for CVE-2023-52425",
"url": "https://bugzilla.suse.com/1219559"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-04-29T11:07:45Z",
"details": "moderate"
}
],
"title": "CVE-2023-52425"
},
{
"cve": "CVE-2023-52426",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-52426"
}
],
"notes": [
{
"category": "general",
"text": "libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-52426",
"url": "https://www.suse.com/security/cve/CVE-2023-52426"
},
{
"category": "external",
"summary": "SUSE Bug 1219561 for CVE-2023-52426",
"url": "https://bugzilla.suse.com/1219561"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-04-29T11:07:45Z",
"details": "moderate"
}
],
"title": "CVE-2023-52426"
},
{
"cve": "CVE-2024-28757",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-28757"
}
],
"notes": [
{
"category": "general",
"text": "libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-28757",
"url": "https://www.suse.com/security/cve/CVE-2024-28757"
},
{
"category": "external",
"summary": "SUSE Bug 1221289 for CVE-2024-28757",
"url": "https://bugzilla.suse.com/1221289"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-04-29T11:07:45Z",
"details": "important"
}
],
"title": "CVE-2024-28757"
},
{
"cve": "CVE-2024-45490",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45490"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45490",
"url": "https://www.suse.com/security/cve/CVE-2024-45490"
},
{
"category": "external",
"summary": "SUSE Bug 1229930 for CVE-2024-45490",
"url": "https://bugzilla.suse.com/1229930"
},
{
"category": "external",
"summary": "SUSE Bug 1229962 for CVE-2024-45490",
"url": "https://bugzilla.suse.com/1229962"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-04-29T11:07:45Z",
"details": "moderate"
}
],
"title": "CVE-2024-45490"
},
{
"cve": "CVE-2024-45491",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45491"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45491",
"url": "https://www.suse.com/security/cve/CVE-2024-45491"
},
{
"category": "external",
"summary": "SUSE Bug 1229930 for CVE-2024-45491",
"url": "https://bugzilla.suse.com/1229930"
},
{
"category": "external",
"summary": "SUSE Bug 1229931 for CVE-2024-45491",
"url": "https://bugzilla.suse.com/1229931"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-04-29T11:07:45Z",
"details": "moderate"
}
],
"title": "CVE-2024-45491"
},
{
"cve": "CVE-2024-45492",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45492"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45492",
"url": "https://www.suse.com/security/cve/CVE-2024-45492"
},
{
"category": "external",
"summary": "SUSE Bug 1229930 for CVE-2024-45492",
"url": "https://bugzilla.suse.com/1229930"
},
{
"category": "external",
"summary": "SUSE Bug 1229932 for CVE-2024-45492",
"url": "https://bugzilla.suse.com/1229932"
},
{
"category": "external",
"summary": "SUSE Bug 1229964 for CVE-2024-45492",
"url": "https://bugzilla.suse.com/1229964"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-04-29T11:07:45Z",
"details": "moderate"
}
],
"title": "CVE-2024-45492"
},
{
"cve": "CVE-2024-50602",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-50602"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-50602",
"url": "https://www.suse.com/security/cve/CVE-2024-50602"
},
{
"category": "external",
"summary": "SUSE Bug 1232579 for CVE-2024-50602",
"url": "https://bugzilla.suse.com/1232579"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-04-29T11:07:45Z",
"details": "moderate"
}
],
"title": "CVE-2024-50602"
},
{
"cve": "CVE-2024-8176",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-8176"
}
],
"notes": [
{
"category": "general",
"text": "A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-8176",
"url": "https://www.suse.com/security/cve/CVE-2024-8176"
},
{
"category": "external",
"summary": "SUSE Bug 1239618 for CVE-2024-8176",
"url": "https://bugzilla.suse.com/1239618"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.aarch64",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.s390x",
"SUSE Linux Micro 6.0:libexpat1-2.7.1-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-04-29T11:07:45Z",
"details": "important"
}
],
"title": "CVE-2024-8176"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…