Search CVE reports

1 – 10 of 39 results

Detailed view

Sort by:

CVE-2024-8176

Medium priority

Some fixes available 4 of 76

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to...

23 affected packages

apache2, apr-util, cmake, ghostscript, texlive-bin...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
cmake	Not affected	Not affected	Not affected	Not affected
ghostscript	Not affected	Not affected	Not affected	Not affected
texlive-bin	Not affected	Not affected	Not affected	Not affected
xmlrpc-c	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vnc4	Not in release	Not in release	Not in release	Needs evaluation
wbxml2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
insighttoolkit4	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
gdcm	Not affected	Not affected	Not affected	Needs evaluation
ayttm	Not in release	Not in release	Not in release	—
cableswig	Not in release	Not in release	Not in release	—
coin3	Not affected	Not affected	Not affected	Needs evaluation
matanza	Ignored	Ignored	Needs evaluation	Needs evaluation
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vtk	Not in release	Not in release	Not in release	—
smart	Not in release	Not in release	Not in release	Needs evaluation
firefox	Not affected	Not affected	Not in release	—
thunderbird	Not affected	Not affected	Not in release	—
libxmltok	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
expat	Fixed	Fixed	Ignored	Ignored

CVE-2024-50602

Medium priority

Some fixes available 7 of 68

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

23 affected packages

expat, apache2, apr-util, cmake, ghostscript...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
expat	Fixed	Fixed	Fixed	Fixed
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
cmake	Not affected	Not affected	Not affected	Not affected
ghostscript	Not affected	Not affected	Not affected	Not affected
texlive-bin	Not affected	Not affected	Not affected	Not affected
xmlrpc-c	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vnc4	Not in release	Not in release	Not in release	Needs evaluation
wbxml2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
insighttoolkit4	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
gdcm	Not affected	Not affected	Not affected	Needs evaluation
ayttm	Not in release	Not in release	Not in release	—
cableswig	Not in release	Not in release	Not in release	—
coin3	Not affected	Not affected	Not affected	Needs evaluation
matanza	Ignored	Ignored	Ignored	Ignored
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vtk	Not in release	Not in release	Not in release	—
smart	Not in release	Not in release	Not in release	Needs evaluation
firefox	Not affected	Not affected	Not in release	—
thunderbird	Not affected	Not affected	Not in release	—
libxmltok	Not affected	Not affected	Not affected	Not affected

CVE-2024-45492

Medium priority

Some fixes available 6 of 67

An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

23 affected packages

apache2, apr-util, cmake, ghostscript, texlive-bin...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
cmake	Not affected	Not affected	Not affected	Not affected
ghostscript	Not affected	Not affected	Not affected	Not affected
texlive-bin	Not affected	Not affected	Not affected	Not affected
xmlrpc-c	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vnc4	Not in release	Not in release	Not in release	Needs evaluation
wbxml2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
insighttoolkit4	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
gdcm	Not affected	Not affected	Not affected	Needs evaluation
ayttm	Not in release	Not in release	Not in release	—
cableswig	Not in release	Not in release	Not in release	—
coin3	Not affected	Not affected	Not affected	Needs evaluation
matanza	Ignored	Ignored	Ignored	Ignored
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vtk	Not in release	Not in release	Not in release	—
smart	Not in release	Not in release	Not in release	Needs evaluation
firefox	Not affected	Not affected	Not in release	—
thunderbird	Not affected	Not affected	Not in release	—
libxmltok	Not affected	Not affected	Not affected	Not affected
expat	Fixed	Fixed	Fixed	Fixed

CVE-2024-45491

Medium priority

Some fixes available 13 of 74

An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

23 affected packages

apache2, apr-util, cmake, ghostscript, texlive-bin...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
cmake	Not affected	Not affected	Not affected	Not affected
ghostscript	Not affected	Not affected	Not affected	Not affected
texlive-bin	Not affected	Not affected	Not affected	Not affected
xmlrpc-c	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vnc4	Not in release	Not in release	Not in release	Needs evaluation
wbxml2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
insighttoolkit4	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
gdcm	Not affected	Not affected	Not affected	Needs evaluation
ayttm	Not in release	Not in release	Not in release	—
cableswig	Not in release	Not in release	Not in release	—
coin3	Not affected	Not affected	Not affected	Needs evaluation
matanza	Ignored	Ignored	Ignored	Ignored
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vtk	Not in release	Not in release	Not in release	—
smart	Not in release	Not in release	Not in release	Needs evaluation
firefox	Not affected	Not affected	Not in release	—
thunderbird	Not affected	Not affected	Not in release	—
libxmltok	Fixed	Fixed	Fixed	Fixed
expat	Fixed	Fixed	Fixed	Fixed

CVE-2024-45490

Medium priority

Some fixes available 13 of 74

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

23 affected packages

expat, apache2, apr-util, cmake, ghostscript...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
expat	Fixed	Fixed	Fixed	Fixed
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
cmake	Not affected	Not affected	Not affected	Not affected
ghostscript	Not affected	Not affected	Not affected	Not affected
texlive-bin	Not affected	Not affected	Not affected	Not affected
xmlrpc-c	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vnc4	Not in release	Not in release	Not in release	Needs evaluation
wbxml2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
insighttoolkit4	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
gdcm	Not affected	Not affected	Not affected	Needs evaluation
ayttm	Not in release	Not in release	Not in release	—
cableswig	Not in release	Not in release	Not in release	—
coin3	Not affected	Not affected	Not affected	Needs evaluation
matanza	Ignored	Ignored	Ignored	Ignored
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vtk	Not in release	Not in release	Not in release	—
smart	Not in release	Not in release	Not in release	Needs evaluation
firefox	Not affected	Not affected	Not in release	—
thunderbird	Not affected	Not affected	Not in release	—
libxmltok	Fixed	Fixed	Fixed	Fixed

CVE-2024-28757

Medium priority

Some fixes available 2 of 81

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

23 affected packages

expat, apache2, apr-util, cmake, ghostscript...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
expat	Not affected	Fixed	Ignored	Ignored
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
cmake	Not affected	Not affected	Not affected	Not affected
ghostscript	Not affected	Not affected	Not affected	Not affected
texlive-bin	Not affected	Not affected	Not affected	Not affected
xmlrpc-c	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vnc4	Not in release	Not in release	Not in release	Needs evaluation
wbxml2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
insighttoolkit4	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
gdcm	Not affected	Not affected	Not affected	Needs evaluation
ayttm	Not in release	Not in release	Not in release	—
cableswig	Not in release	Not in release	Not in release	—
coin3	Not affected	Not affected	Not affected	Needs evaluation
matanza	Ignored	Ignored	Ignored	Ignored
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vtk	Not in release	Not in release	Not in release	—
smart	Not in release	Not in release	Not in release	Needs evaluation
firefox	Not affected	Not affected	Not in release	—
thunderbird	Not affected	Not affected	Not in release	—
libxmltok	Ignored	Ignored	Ignored	Ignored

CVE-2023-52426

Medium priority

Some fixes available 3 of 53

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

23 affected packages

tdom, vtk, expat, apache2, apr-util...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vtk	Not in release	Not in release	Not in release	Not in release
expat	Fixed	Not affected	Not affected	Not affected
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
cmake	Not affected	Not affected	Not affected	Not affected
ghostscript	Not affected	Not affected	Not affected	Not affected
texlive-bin	Not affected	Not affected	Not affected	Not affected
xmlrpc-c	Needs evaluation	Not affected	Not affected	Not affected
vnc4	Not in release	Not in release	Not in release	Not affected
wbxml2	Needs evaluation	Not affected	Not affected	Not affected
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
insighttoolkit4	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
gdcm	Not affected	Not affected	Not affected	Not affected
ayttm	Not in release	Not in release	Not in release	Not in release
cableswig	Not in release	Not in release	Not in release	Not in release
coin3	Not affected	Not affected	Not affected	Needs evaluation
matanza	Ignored	Ignored	Ignored	Ignored
smart	Not in release	Not in release	Not in release	Not affected
firefox	Not affected	Not affected	Not in release	Ignored
thunderbird	Not affected	Not affected	Not in release	Ignored
libxmltok	Not affected	Not affected	Not affected	Not affected

CVE-2023-52425

Medium priority

Some fixes available 5 of 81

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

23 affected packages

expat, apache2, apr-util, cmake, ghostscript...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
expat	Fixed	Fixed	Ignored	Ignored
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
cmake	Not affected	Not affected	Not affected	Not affected
ghostscript	Not affected	Not affected	Not affected	Not affected
texlive-bin	Not affected	Not affected	Not affected	Not affected
xmlrpc-c	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vnc4	Not in release	Not in release	Not in release	Needs evaluation
wbxml2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
insighttoolkit4	Not in release	Needs evaluation	Needs evaluation	Needs evaluation
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
gdcm	Not affected	Not affected	Not affected	Not affected
ayttm	Not in release	Not in release	Not in release	Not in release
cableswig	Not in release	Not in release	Not in release	Not in release
coin3	Not affected	Not affected	Not affected	Needs evaluation
matanza	Ignored	Ignored	Ignored	Ignored
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
vtk	Not in release	Not in release	Not in release	Not in release
smart	Not in release	Not in release	Not in release	Not affected
firefox	Not affected	Not affected	Not in release	Ignored
thunderbird	Not affected	Not affected	Not in release	Ignored
libxmltok	Ignored	Ignored	Ignored	Ignored

CVE-2022-43680

Medium priority

Some fixes available 11 of 94

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

24 affected packages

xmlrpc-c, cableswig, apache2, apr-util, cmake...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
xmlrpc-c	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
cableswig	—	Not in release	Not in release	Not in release
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
cmake	Not affected	Not affected	Not affected	Not affected
expat	Fixed	Fixed	Fixed	Fixed
ghostscript	Not affected	Not affected	Not affected	Not affected
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
texlive-bin	Not affected	Not affected	Not affected	Not affected
vnc4	—	Not in release	Not in release	Needs evaluation
wbxml2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
ayttm	—	Not in release	Not in release	Not in release
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
coin3	Not affected	Not affected	Not affected	Needs evaluation
firefox	Not affected	Not affected	Not in release	Ignored
gdcm	Not affected	Not affected	Not affected	Not affected
insighttoolkit	—	Not in release	Not in release	Not in release
insighttoolkit4	Not in release	Not affected	Not affected	Not affected
libxmltok	Not affected	Not affected	Not affected	Not affected
matanza	Ignored	Ignored	Ignored	Ignored
smart	—	Not in release	Not in release	Not affected
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
thunderbird	Ignored	Ignored	Not in release	Ignored
vtk	—	Not in release	Not in release	Not in release

CVE-2022-40674

Medium priority

Some fixes available 13 of 118

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

24 affected packages

firefox, cadaver, coin3, gdcm, libxmltok...

Package	24.04 LTS	22.04 LTS	20.04 LTS	18.04 LTS
firefox	Not affected	Not affected	Fixed	Fixed
cadaver	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
coin3	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
gdcm	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
libxmltok	Not affected	Not affected	Not affected	Not affected
matanza	Ignored	Ignored	Ignored	Ignored
swish-e	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
tdom	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
thunderbird	Ignored	Ignored	Not in release	Ignored
wbxml2	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
xmlrpc-c	Needs evaluation	Needs evaluation	Needs evaluation	Needs evaluation
insighttoolkit4	Not in release	Not affected	Not affected	Not affected
cmake	Not affected	Not affected	Not affected	Not affected
expat	Fixed	Fixed	Fixed	Fixed
apache2	Not affected	Not affected	Not affected	Not affected
apr-util	Not affected	Not affected	Not affected	Not affected
ayttm	—	Not in release	Not in release	Not in release
cableswig	—	Not in release	Not in release	Not in release
smart	—	Not in release	Not in release	Needs evaluation
ghostscript	Not affected	Not affected	Not affected	Not affected
insighttoolkit	—	Not in release	Not in release	Not in release
texlive-bin	Not affected	Not affected	Not affected	Not affected
vnc4	—	Not in release	Not in release	Needs evaluation
vtk	—	Not in release	Not in release	Not in release

Export to JSON

Results by page: