PT-2024-6340 · Libexpat+11 · Libexpat+11

Taiyou · CVE-2024-45491 · Publicado 2024-08-26 · Atualizado 2026-04-01

Positive Technologies (AI Summary) · Pt

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Nome do software vulnerável e versões afetadas

Versões da libexpat anteriores à 2.6.3

Descrição

Foi descoberta uma vulnerabilidade no libexpat relacionada a um estouro de inteiro na função dtdCopy() no arquivo xmlparse.c. Essa vulnerabilidade pode ocorrer em plataformas de 32 bits e pode permitir que um invasor remoto cause uma negação de serviço ou execute código arbitrário.

Recomendações

Para versões do libexpat anteriores à 2.6.3, atualize para a versão 2.6.3 ou posterior para resolver o problema. Como solução temporária, considere restringir o uso da função dtdCopy() no arquivo xmlparse.c até que um patch esteja disponível.

Exploit

Correção

DoS

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALSA-2024:6754

ALSA-2024:6989

ALSA-2024:8859

ALT-PU-2024-17539

AZL-48430

AZL-48454

BDU:2024-07376

BDU:2024-07377

CESA-2024_6989

CESA-2024_8859

CLEANSTART-2026-EM10970

CLEANSTART-2026-MH09144

CLEANSTART-2026-YT18139

CVE-2024-45491

DLA-3893-1

DSA-5770-1

INFSA-2024_6754

INFSA-2024_6989

INFSA-2024_8859

MGASA-2024-0294

MGASA-2024-0338

OESA-2024-2121

OESA-2024-2138

OPENSUSE-SU-2024:14322-1

OPENSUSE-SU-2024:14328-1

OPENSUSE-SU-2024:14379-1

OPENSUSE-SU-2024:14380-1

OPENSUSE-SU-2024:14381-1

OPENSUSE-SU-2024_3216-1

OPENSUSE-SU-2024_3538-1

OPENSUSE-SU-2024_3554-1

RHSA-2024:6754

RHSA-2024:6989

RHSA-2024:8859

RHSA-2024_6754

RHSA-2024_6989

RHSA-2024_8859

RLSA-2024:6754

RLSA-2024:6989

RLSA-2024:8859

SUSE-SU-2024:3182-1

SUSE-SU-2024:3216-1

SUSE-SU-2024:3515-1

SUSE-SU-2024:3538-1

SUSE-SU-2024:3554-1

SUSE-SU-2025:20045-1

SUSE-SU-2025:20207-1

SUSE-SU-2025:20311-1

SUSE-SU-2025:4512-1

SUSE-SU-2026:0044-1

USN-7000-1

USN-7000-2

USN-7001-1

USN-7001-2

Produtos afetados

Alt Linux

Almalinux

Centos

Debian

Ibm Aix

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Libexpat

Referências · 217

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45491.json · Exploit
• https://github.com/libexpat/libexpat/issues/889 · Nota
• https://github.com/libexpat/libexpat/pull/892 · Nota
• https://github.com/libexpat/libexpat/pull/891 · Correção
• https://github.com/libexpat/libexpat/issues/888 · Nota
• https://github.com/libexpat/libexpat/blob/R_2_6_3/expat/Changes · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-YT18139 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-MH09144 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-EM10970.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-MH09144.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-YT18139.json · Nota
• https://bugs.mageia.org/show_bug.cgi?id=33547 · Nota
• https://osv.dev/vulnerability/CVE-2022-22825 · Nota
• https://bugzilla.suse.com/1239618 · Nota
• https://suse.com/security/cve/CVE-2024-8176 · Nota