Описание
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.
A flaw was found in expat. On 32-bit systems, an integer overflow occurs within the expat_realloc memory allocation function when calculating buffer sizes. A remote attacker can exploit this vulnerability by supplying specially crafted XML input to an application that processes data with the library. Successful exploitation can lead to a Denial of Service (DoS) or memory corruption.
Отчет
A flaw of moderate impact was found in the expat XML parser library (libexpat), which is shipped in Red Hat Enterprise Linux and Fedora. On 32-bit systems, an integer overflow can occur in the expat_realloc() memory allocation function when buffer sizes are calculated, resulting in an undersized heap allocation that can lead to a heap buffer overflow, memory corruption, or a crash. A remote attacker can supply specially crafted XML input to an application that processes data with the vulnerable library, causing a denial of service of that application; no privileges or user interaction are required, but exploitation is limited to 32-bit platforms and requires triggering specific allocation sizes, so attack complexity is high. Red Hat Product Security rates this flaw Moderate (CVSS 3.1 score 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), which differs from the upstream CVSS 4.0 rating of Important (8.2) because the vulnerability is restricted to 32-bit architectures with high attack complexity and its impact is limited to availability. Affected expat and mingw-expat components span Red Hat Enterprise Linux 6 through 10, Red Hat In-Vehicle OS, Red Hat Hardened Images, and Fedora. For Red Hat Enterprise Linux and UBI-related streams, fixes are being pursued through delegated updates. For several maintenance streams the fix is deferred because the flaw is Moderate severity with a CVSS score below 7.0, leaving a residual risk of denial of service or memory corruption on 32-bit deployments until a fix is delivered. Red Hat Enterprise Linux 6 and certain platform streams are out of support scope and will not be fixed. The expat package in Red Hat Hardened Images (Hummingbird) is not affected because the vulnerable code is not present.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | firefox | Fix deferred | ||
| Red Hat Enterprise Linux 10 | thunderbird | Fix deferred | ||
| Red Hat Enterprise Linux 6 | compat-expat1 | Out of support scope | ||
| Red Hat Enterprise Linux 6 | expat | Out of support scope | ||
| Red Hat Enterprise Linux 7 | expat | Fix deferred | ||
| Red Hat Enterprise Linux 7 | firefox | Fix deferred | ||
| Red Hat Enterprise Linux 8 | expat | Fix deferred | ||
| Red Hat Enterprise Linux 8 | firefox | Fix deferred | ||
| Red Hat Enterprise Linux 8 | mingw-expat | Fix deferred | ||
| Red Hat Enterprise Linux 8 | thunderbird | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.
libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vuln ...
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.
EPSS
5.9 Medium
CVSS3