CVE-2024-45490

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.(CVE-2024-45490)

XML-RPC is a quick-and-easy way to make procedure calls over the Internet. It converts the procedure call into an XML document, sends it to a remote server using HTTP, and gets back the response as XML.

Security Fix(es):

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.(CVE-2024-45490)

An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).(CVE-2024-45491)

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.

Expat is a C library for parsing XML documents.

Security Fix(es):

• libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)
• libexpat: Integer Overflow or Wraparound (CVE-2024-45491)
• libexpat: integer overflow (CVE-2024-45492)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat is a C library for parsing XML documents.

Security Fix(es):

• libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)
• libexpat: Integer Overflow or Wraparound (CVE-2024-45491)
• libexpat: integer overflow (CVE-2024-45492)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2024-45490: reject negative length in XML_ParseBuffer
• CVE-2024-45491: detect integer overflow in dtdCopy on 32-bit platforms
• CVE-2024-45492: detect integer overflow in nextScaffoldPart on 32-bit platforms

• The release version was raised because it corresponds to version 13
• CVE-2024-45490: reject negative len for XML_ParseBuffer to prevent improper restriction of XML External Entity Reference
• CVE-2024-45491: prevent integer overflow in dtdCopy
• CVE-2024-45492: prevent integer overflow in nextScaffoldPart

• The release version was raised because it corresponds to version 13
• CVE-2024-45490: reject negative len for XML_ParseBuffer to prevent improper restriction of XML External Entity Reference
• CVE-2024-45491: prevent integer overflow in dtdCopy
• CVE-2024-45492: prevent integer overflow in nextScaffoldPart

• The release version was raised because it corresponds to version 13
• CVE-2024-45490: reject negative len for XML_ParseBuffer to prevent improper restriction of XML External Entity Reference
• CVE-2024-45491: prevent integer overflow in dtdCopy
• CVE-2024-45492: prevent integer overflow in nextScaffoldPart

• CVE-2024-45490: Reject negative length for XML_ParseBuffer in xmlparse.c
• CVE-2024-45491: Detect integer overflow in dtdCopy on 32-bit platforms
• CVE-2024-45492: Detect integer overflow in nextScaffoldPart on 32-bit platforms

• SECURITY UPDATE: Improper restriction of XML External Entity Reference
  • debian/patches/CVE-2024-45490.patch: Reject negative len for XML_ParseBuffer
  • CVE-2024-45490

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. (CVE-2024-45490) An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45491) An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. (CVE-2024-45490) An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45491) An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

These are all security issues fixed in the expat-2.6.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the x3270-4.3-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libmozjs-115-0-115.4.0-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libmozjs-128-0-128.2.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libmozjs-78-0-78.15.0-5.1 package on the GA media of openSUSE Tumbleweed.

Expat is a C library for parsing XML documents.

Security Fix(es):

• libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)

• libexpat: Integer Overflow or Wraparound (CVE-2024-45491)

• libexpat: integer overflow (CVE-2024-45492)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat is a C library for parsing XML documents.

Security Fix(es):

• libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)

• libexpat: Integer Overflow or Wraparound (CVE-2024-45491)

• libexpat: integer overflow (CVE-2024-45492)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for expat fixes the following issues:

• CVE-2024-45492: Detect integer overflow in function nextScaffoldPart. (bsc#1229932)
• CVE-2024-45491: Detect integer overflow in dtdCopy. (bsc#1229931)
• CVE-2024-45490: Reject negative len for XML_ParseBuffer. (bsc#1229930)

This update for expat fixes the following issues:

• CVE-2024-45492: integer overflow in function nextScaffoldPart. (bsc#1229932)
• CVE-2024-45491: integer overflow in dtdCopy. (bsc#1229931)
• CVE-2024-45490: negative length for XML_ParseBuffer not rejected. (bsc#1229930)

This update for expat fixes the following issues:

• CVE-2024-45492: integer overflow in function nextScaffoldPart. (bsc#1229932)
• CVE-2024-45491: integer overflow in dtdCopy. (bsc#1229931)
• CVE-2024-45490: negative length for XML_ParseBuffer not rejected. (bsc#1229930)

This update for mozjs115 fixes the following issues:

• CVE-2024-45490: Fixed negative len for XML_ParseBuffer in embedded expat (bnc#1230036)
• CVE-2024-45491: Fixed integer overflow in dtdCopy in embedded expat (bnc#1230037)
• CVE-2024-45492: Fixed integer overflow in function nextScaffoldPart in embedded expat (bnc#1230038)

This update for mozjs78 fixes the following issues:

• CVE-2024-45490: Fixed negative len for XML_ParseBuffer in embedded expat (bnc#1230036)
• CVE-2024-45491: Fixed integer overflow in dtdCopy in embedded expat (bnc#1230037)
• CVE-2024-45492: Fixed integer overflow in function nextScaffoldPart in embedded expat (bnc#1230038)

This update for expat fixes the following issues:

• CVE-2024-45492: detect integer overflow in function nextScaffoldPart (bsc#1229932)
• CVE-2024-45491: detect integer overflow in dtdCopy (bsc#1229931)
• CVE-2024-45490: reject negative len for XML_ParseBuffer (bsc#1229930)
• CVE-2024-28757: XML Entity Expansion attack when there is isolated use of external parsers (bsc#1221289)

This update for expat fixes the following issues:

Version update to 2.7.1:

• Bug fixes:

  • Restore event pointer behavior from Expat 2.6.4 (that the fix to CVE-2024-8176 changed in 2.7.0); affected API functions are:

    • XML_GetCurrentByteCount
    • XML_GetCurrentByteIndex
    • XML_GetCurrentColumnNumber
    • XML_GetCurrentLineNumber
    • XML_GetInputContext

  • Other changes: #976 #977 Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}" with Automake that were missing from 2.7.0 release tarballs #983 #984 Fix printf format specifiers for 32bit Emscripten #992 docs: Promote OpenSSF Best Practices self-certification #978 tests/benchmark: Resolve mistaken double close #986 Address compiler warnings #990 #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1) to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/ for what these numbers do

    Infrastructure:
        #982  CI: Start running Perl XML::Parser integration tests
        #987  CI: Enforce Clang Static Analyzer clean code
        #991  CI: Re-enable warning clang-analyzer-valist.Uninitialized
                for clang-tidy
        #981  CI: Cover compilation with musl
    

    #983 #984 CI: Cover compilation with 32bit Emscripten #976 #977 CI: Protect against fuzzer files missing from future release archives

Version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])

• Security fixes:

  • CVE-2024-8176 -- Fix crash from chaining a large number of entities caused by stack overflow by resolving use of recursion, for all three uses of entities:
    • general entities in character data ("<e>&g1;</e>")
    • general entities in attribute values ("<e k1='&g1;'/>")
    • parameter entities ("%p1;")

  Known impact is (reliable and easy) denial of service:

  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C

  (Base Score: 7.5, Temporal Score: 7.2)

  Please note that a layer of compression around XML can significantly reduce the minimum attack payload size.

  • Other changes:
    • Document changes since the previous release
    • Version info bumped from 11:0:10 (libexpat*.so.1.10.0) to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/ for what these numbers do

Version update to 2.6.4:

• Security fixes: [bsc#1232601][bsc#1232579]
  • CVE-2024-50602 -- Fix crash within function XML_ResumeParser from a NULL pointer dereference by disallowing function XML_StopParser to (stop or) suspend an unstarted parser. A new error code XML_ERROR_NOT_STARTED was introduced to properly communicate this situation. // CWE-476 CWE-754
• Other changes:
  • Version info bumped from 10:3:9 (libexpat*.so.1.9.3) to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/ for what these numbers do

Update to 2.6.3:

• Security fixes:
  • CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with len < 0 without noticing and then calling XML_GetBuffer will have XML_ParseBuffer fail to recognize the problem and XML_GetBuffer corrupt memory. With the fix, XML_ParseBuffer now complains with error XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse has been doing since Expat 2.2.1, and now documented. Impact is denial of service to potentially artitrary code execution.
  • CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). Impact is denial of service to potentially artitrary code execution.
  • CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). Impact is denial of service to potentially…

This update for expat fixes the following issues:

Version update to 2.7.1:

 Bug fixes:

   #980 #989  Restore event pointer behavior from Expat 2.6.4
                (that the fix to CVE-2024-8176 changed in 2.7.0);
                affected API functions are:
                - XML_GetCurrentByteCount
                - XML_GetCurrentByteIndex
                - XML_GetCurrentColumnNumber
                - XML_GetCurrentLineNumber
                - XML_GetInputContext

 Other changes:

   #976 #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
                with Automake that were missing from 2.7.0 release tarballs
   #983 #984  Fix printf format specifiers for 32bit Emscripten
        #992  docs: Promote OpenSSF Best Practices self-certification
        #978  tests/benchmark: Resolve mistaken double close
        #986  Address compiler warnings
   #990 #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
                to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
                for what these numbers do

    Infrastructure:

        #982  CI: Start running Perl XML::Parser integration tests
        #987  CI: Enforce Clang Static Analyzer clean code
        #991  CI: Re-enable warning clang-analyzer-valist.Uninitialized
                for clang-tidy
        #981  CI: Cover compilation with musl
   #983 #984  CI: Cover compilation with 32bit Emscripten
   #976 #977  CI: Protect against fuzzer files missing from future
                release archives

version update to 2.7.0 (CVE-2024-8176 [bsc#1239618]):

• Security fixes:

  #893 #973 CVE-2024-8176 -- Fix crash from chaining a large number of entities caused by stack overflow by resolving use of recursion, for all three uses of entities: - general entities in character data ("<e>&g1;</e>") - general entities in attribute values ("<e k1='&g1;'/>") - parameter entities ("%p1;") Known impact is (reliable and easy) denial of service: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C (Base Score: 7.5, Temporal Score: 7.2) Please note that a layer of compression around XML can significantly reduce the minimum attack payload size.

• Other changes: #935 #937 Autotools: Make generated CMake files look for libexpat.@[email protected] on macOS #925 Autotools: Sync CMake templates with CMake 3.29 #945 #962 #966 CMake: Drop support for CMake <3.13 #942 CMake: Small fuzzing related improvements #921 docs: Add missing documentation of error code XML_ERROR_NOT_STARTED that was introduced with 2.6.4 #941 docs: Document need for C++11 compiler for use from C++ #959 tests/benchmark: Fix a (harmless) TOCTTOU #944 Windows: Fix installer target location of file xmlwf.xml for CMake #953 Windows: Address warning -Wunknown-warning-option about -Wno-pedantic-ms-format from LLVM MinGW #971 Address Cppcheck warnings #969 #970 Mass-migrate links from http:// to https:// #947 #958 .. #974 #975 Document changes since the previous release #974 #975 Version info bumped from 11:0:10 (libexpat*.so.1.10.0) to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/ for what these numbers do

• no source changes, just adding jira reference: jsc#SLE-21253

Version update to 2.6.4

• Security fixes: [bsc#1232601][bsc#1232579] #915 CVE-2024-50602 -- Fix crash within function XML_ResumeParser from a NULL pointer dereference by disallowing function …

This update for mozjs52 fixes the following issues:

• CVE-2024-45491: Fixed integer overflow in dtdCopy (bsc#1230037)
• CVE-2024-50602: Fixed DoS via XML_ResumeParser (bsc#1232599)
• CVE-2024-45492: Fixed integer overflow in function nextScaffoldPart (bsc#1230038)
• CVE-2024-45490: Fixed negative len for XML_ParseBuffer (bsc#1230036)

This update for mozjs60 fixes the following issues:

• CVE-2024-45492: embedded expat: detect integer overflow in function nextScaffoldPart (bsc#1230038)
• CVE-2024-45491: embedded expat: detect integer overflow in dtdCopy (bsc#1230037)
• CVE-2024-45490: embedded expat: reject negative len for XML_ParseBuffer (bsc#1230036)
• CVE-2024-50602: libexpat: DoS via XML_ResumeParser (bsc#1232602)

Shang-Hung Wan discovered that Expat did not properly handle certain function calls when a negative input length was provided. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2024-45490)

Shang-Hung Wan discovered that Expat did not properly handle the potential for an integer overflow on 32-bit platforms. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2024-45491, CVE-2024-45492)

USN-7000-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for Ubuntu 22.04 LTS.

Original advisory details:

Shang-Hung Wan discovered that Expat did not properly handle certain function calls when a negative input length was provided. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2024-45490)

Shang-Hung Wan discovered that Expat did not properly handle the potential for an integer overflow on 32-bit platforms. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2024-45491, CVE-2024-45492)

Shang-Hung Wan discovered that Expat, contained within the xmltok library, did not properly handle certain function calls when a negative input length was provided. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2024-45490)

Shang-Hung Wan discovered that Expat, contained within the xmltok library, did not properly handle the potential for an integer overflow on 32-bit platforms. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2024-45491)

USN-7001-1 fixed vulnerabilities in xmltol library. This update provides the corresponding updates for Ubuntu 24.04 LTS.

Original advisory details:

Shang-Hung Wan discovered that Expat, contained within the xmltok library, did not properly handle certain function calls when a negative input length was provided. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2024-45490)

Shang-Hung Wan discovered that Expat, contained within the xmltok library, did not properly handle the potential for an integer overflow on 32-bit platforms. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2024-45491)