PT-2024-2082 · Libexpat+11 · Libexpat+11
Carnil
·
Published
2024-03-09
·
Updated
2026-06-05
·
CVE-2024-28757
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libexpat versions 2.6.1 and earlier
libexpat through 2.6.1
Description
The issue is related to the improper handling of XML external entity (XXE) declarations by the
XML ExternalEntityParserCreate function, allowing an XML Entity Expansion attack. This can be exploited by a remote attacker to obtain sensitive information or cause a denial of service by sending specially crafted XML content. The estimated number of potentially affected devices is not specified.Recommendations
For libexpat versions 2.6.1 and earlier, update to version 2.6.2 or later to resolve the issue.
As a temporary workaround, consider disabling the use of external parsers created via
XML ExternalEntityParserCreate until a patch is available.
Restrict access to sensitive information and minimize the risk of exploitation by limiting the use of libexpat in sensitive environments.Fix
DoS
RCE
XML Entity Expansion
XXE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Ibm Aix
Linuxmint
Red Hat
Red Os
Suse
Ubuntu
Libexpat