Headline
Ubuntu Security Notice USN-7001-1
Ubuntu Security Notice 7001-1 - Shang-Hung Wan discovered that Expat, contained within the xmltok library, did not properly handle certain function calls when a negative input length was provided. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. Shang-Hung Wan discovered that Expat, contained within the xmltok library, did properly handle the potential for an integer overflow on 32-bit platforms. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code.
==========================================================================Ubuntu Security Notice USN-7001-1September 12, 2024libxmltok vulnerabilities==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 22.04 LTS- Ubuntu 20.04 LTS- Ubuntu 18.04 LTS- Ubuntu 16.04 LTSSummary:Several security issues were fixed in libxmltok.Software Description:- libxmltok: XML Parser Toolkit, runtime librariesDetails:Shang-Hung Wan discovered that Expat, contained within the xmltok library,did not properly handle certain function calls when a negative input lengthwas provided. An attacker could use this issue to cause a denial of serviceor possibly execute arbitrary code. (CVE-2024-45490)Shang-Hung Wan discovered that Expat, contained within the xmltok library,did properly handle the potential for an integer overflow on 32-bitplatforms. An attacker could use this issue to cause a denial of service orpossibly execute arbitrary code. (CVE-2024-45491)Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 22.04 LTS libxmltok1 1.2-4ubuntu0.22.04.1~esm3 Available with Ubuntu ProUbuntu 20.04 LTS libxmltok1 1.2-4ubuntu0.20.04.1~esm3 Available with Ubuntu ProUbuntu 18.04 LTS libxmltok1 1.2-4ubuntu0.18.04.1~esm3 Available with Ubuntu ProUbuntu 16.04 LTS libxmltok1 1.2-3ubuntu0.16.04.1~esm4 Available with Ubuntu ProIn general, a standard system update will make all the necessary changes.References: https://ubuntu.com/security/notices/USN-7001-1 CVE-2024-45490, CVE-2024-45491Related news
Red Hat Security Advisory 2024-7599-03 - Red Hat OpenShift Container Platform release 4.16.16 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include code execution, denial of service, integer overflow, and out of bounds write vulnerabilities.
Red Hat Security Advisory 2024-6754-03 - An update for expat is now available for Red Hat Enterprise Linux 9. Issues addressed include an integer overflow vulnerability.
Debian Linux Security Advisory 5770-1 - Shang-Hung Wan discovered multiple vulnerabilities in the Expat XML parsing C library, which could result in denial of service or potentially the execution of arbitrary code.
Ubuntu Security Notice 7000-2 - USN-7000-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for Ubuntu 22.04 LTS. Shang-Hung Wan discovered that Expat did not properly handle certain function calls when a negative input length was provided. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code.
Ubuntu Security Notice 7001-2 - USN-7001-1 fixed vulnerabilities in xmltol library. This update provides the corresponding updates for Ubuntu 24.04 LTS. Shang-Hung Wan discovered that Expat, contained within the xmltok library, did not properly handle certain function calls when a negative input length was provided. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code.
Ubuntu Security Notice 7000-1 - Shang-Hung Wan discovered that Expat did not properly handle certain function calls when a negative input length was provided. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. Shang-Hung Wan discovered that Expat did properly handle the potential for an integer overflow on 32-bit platforms. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code.