Описание
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
A flaw was found in libexpat. Specifically, the xmlwf utility contains an integer overflow vulnerability in its resolveSystemId function. This flaw could be exploited by an attacker to potentially gain unauthorized access to sensitive information or execute arbitrary code, leading to a compromise of the system's integrity and confidentiality.
Отчет
This Moderate impact vulnerability in libexpat's xmlwf utility, an integer overflow in resolveSystemId, could lead to information disclosure or arbitrary code execution. Exploitation requires local access and high attack complexity. Red Hat products that process untrusted XML input via xmlwf, including certain components of Red Hat Ansible Automation Platform and Red Hat OpenShift AI, are potentially affected.
Меры по смягчению последствий
To reduce the risk associated with this vulnerability, avoid processing untrusted or maliciously crafted XML files using the xmlwf utility. Ensure that xmlwf is only invoked with XML data from known and trusted sources.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Fix deferred | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/lightspeed-chatbot-rhel9 | Fix deferred | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/lightspeed-chatbot-rhel9 | Fix deferred | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-llama-stack-core-rhel9 | Fix deferred | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mlflow-rhel9 | Fix deferred | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.9 Medium
CVSS3
Связанные уязвимости
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSyste ...
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
EPSS
6.9 Medium
CVSS3