CVE-2024-50602

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.(CVE-2024-50602)

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

Expat is a C library for parsing XML documents.

Security Fix(es):

• libexpat: expat: DoS via XML_ResumeParser (CVE-2024-50602)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Expat is a C library for parsing XML documents.

Security Fix(es):

• libexpat: expat: DoS via XML_ResumeParser (CVE-2024-50602)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

• CVE-2024-50602: Fix crash in XML_ResumeParser function by preventing XML_StopParser from stopping/suspending unstarted parser

• CVE-2024-50602: Fix crash in XML_ResumeParser function by preventing XML_StopParser from stopping/suspending unstarted parser

• CVE-2024-50602: Fix crash in XML_ResumeParser function by preventing XML_StopParser from stopping/suspending unstarted parser

• CVE-2024-50602: Fix crash in XML_ResumeParser by preventing XML_StopParser from stopping/suspending unstarted parser

• SECURITY UPDATE: Crash in XML_ResumeParser function
  • debian/patches/CVE-2024-50602.patch: Refuse to stop/suspend an unstarted parser (XML_ERROR_NOT_STARTED). Fix XML_StopParser to be explicit about XML_PARSING and handle default case. Cover XML_StopParser's new handling of status XML_INITIALIZED, Fix crash with NULL pointer dereference in normal_updatePosition
  • CVE-2024-50602

• SECURITY UPDATE: Crash in XML_ResumeParser due to XML_StopParser issue
  • debian/patches/CVE-2024-50602.patch: Refuse to stop/suspend an unstarted parser due to XML_ERROR_NOT_STARTED
  • debian/patches/CVE-2024-50602-1.patch: Explicitly specify XML_PARSING in XML_StopParser to ensure correct parsing status handling
  • debian/patches/CVE-2024-50602-2.patch: Add test_misc_resumeparser_not_crashing and test_misc_stopparser_rejects_unstarted_parser to cover the issue
  • CVE-2024-50602

• CVE-2022-25313: prevent stack exhaustion in build_model
• CVE-2024-50602: make XML_StopParser refuse to stop/suspend an unstarted parser

• SECURITY UPDATE: Crash in XML_ResumeParser because XML_StopParser can stop/suspend an unstarted parser
  • debian/patches/CVE-2024-50602.patch: make XML_StopParser refuse to stop/suspend an unstarted parser
  • CVE-2024-50602

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. (CVE-2024-50602)

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. (CVE-2024-50602)

These are all security issues fixed in the xsd-4.1.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gama-2.31-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the audacity-3.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the expat-2.6.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libmozjs-115-0-115.15.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libmozjs-128-0-128.5.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libmozjs-78-0-78.15.0-7.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libparaview5_12-5.12.1-2.1 package on the GA media of openSUSE Tumbleweed.

Expat is a C library for parsing XML documents.

Security Fix(es):

• libexpat: expat: DoS via XML_ResumeParser (CVE-2024-50602)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for python-wxPython fixes the following issues:

Security issue fixed:

• CVE-2024-50602: Fixed a denial of service in the vendored libexpat's XML_ResumeParser function (bsc#1232590).

Non-security issues fixed:

• rebuilt for python 3.11 (bsc#1228252).
• add repack script, do not include packaging/ dir in sources
• Reduce complexity by not rewriting subpackages at all.
• Appease factory-auto bot about package src name.
• Add additional patches fixing the situation with Python 3.10 compatibility.
• Split out the TW python3 flavors into multibuild using the python_subpackage_only mechanism: Multiple python3 flavors sequentially require too much space and time in one build.

This update for expat fixes the following issues:

• CVE-2024-50602: Fixed a denial of service via XML_ResumeParser (bsc#1232579).

This update for expat fixes the following issues:

• CVE-2024-50602: Fixed a denial of service via XML_ResumeParser (bsc#1232579).

This update for python3-wxPython fixes the following issues:

• CVE-2024-50602: Fixed a denial of service in the vendored libexpat's XML_ResumeParser function (bsc#1232590).

This update for expat fixes the following issues:

• CVE-2024-50602: Fixed a denial of service via XML_ResumeParser (bsc#1232579).

This update for mozjs115 fixes the following issues:

• CVE-2024-11498: Fixed resource exhaustion via Stack overflow in libjxl (bsc#1233786)
• CVE-2024-11403: Fixed out of Bounds Memory Read/Write in libjxl (bsc#1233766)
• CVE-2024-50602: Fixed DoS via XML_ResumeParser in libexpat (bsc#1232602)

This update for mozjs78 fixes the following issues:

• CVE-2024-50602: Fixed DoS via XML_ResumeParser (bsc#1232599)

This update for expat fixes the following issues:

• CVE-2024-50602: Fixed possible denial-of-service vulnerability inside XML_ResumeParser (bsc#1232579).

This update for expat fixes the following issues:

Version update to 2.7.1:

• Bug fixes:

  • Restore event pointer behavior from Expat 2.6.4 (that the fix to CVE-2024-8176 changed in 2.7.0); affected API functions are:

    • XML_GetCurrentByteCount
    • XML_GetCurrentByteIndex
    • XML_GetCurrentColumnNumber
    • XML_GetCurrentLineNumber
    • XML_GetInputContext

  • Other changes: #976 #977 Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}" with Automake that were missing from 2.7.0 release tarballs #983 #984 Fix printf format specifiers for 32bit Emscripten #992 docs: Promote OpenSSF Best Practices self-certification #978 tests/benchmark: Resolve mistaken double close #986 Address compiler warnings #990 #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1) to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/ for what these numbers do

    Infrastructure:
        #982  CI: Start running Perl XML::Parser integration tests
        #987  CI: Enforce Clang Static Analyzer clean code
        #991  CI: Re-enable warning clang-analyzer-valist.Uninitialized
                for clang-tidy
        #981  CI: Cover compilation with musl
    

    #983 #984 CI: Cover compilation with 32bit Emscripten #976 #977 CI: Protect against fuzzer files missing from future release archives

Version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])

• Security fixes:

  • CVE-2024-8176 -- Fix crash from chaining a large number of entities caused by stack overflow by resolving use of recursion, for all three uses of entities:
    • general entities in character data ("<e>&g1;</e>")
    • general entities in attribute values ("<e k1='&g1;'/>")
    • parameter entities ("%p1;")

  Known impact is (reliable and easy) denial of service:

  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C

  (Base Score: 7.5, Temporal Score: 7.2)

  Please note that a layer of compression around XML can significantly reduce the minimum attack payload size.

  • Other changes:
    • Document changes since the previous release
    • Version info bumped from 11:0:10 (libexpat*.so.1.10.0) to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/ for what these numbers do

Version update to 2.6.4:

• Security fixes: [bsc#1232601][bsc#1232579]
  • CVE-2024-50602 -- Fix crash within function XML_ResumeParser from a NULL pointer dereference by disallowing function XML_StopParser to (stop or) suspend an unstarted parser. A new error code XML_ERROR_NOT_STARTED was introduced to properly communicate this situation. // CWE-476 CWE-754
• Other changes:
  • Version info bumped from 10:3:9 (libexpat*.so.1.9.3) to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/ for what these numbers do

Update to 2.6.3:

• Security fixes:
  • CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with len < 0 without noticing and then calling XML_GetBuffer will have XML_ParseBuffer fail to recognize the problem and XML_GetBuffer corrupt memory. With the fix, XML_ParseBuffer now complains with error XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse has been doing since Expat 2.2.1, and now documented. Impact is denial of service to potentially artitrary code execution.
  • CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). Impact is denial of service to potentially artitrary code execution.
  • CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). Impact is denial of service to potentially…

This update for expat fixes the following issues:

-CVE-2024-50602: Fixed DoS via XML_ResumeParser (bsc#1232579).

This update for expat fixes the following issues:

Version update to 2.7.1:

 Bug fixes:

   #980 #989  Restore event pointer behavior from Expat 2.6.4
                (that the fix to CVE-2024-8176 changed in 2.7.0);
                affected API functions are:
                - XML_GetCurrentByteCount
                - XML_GetCurrentByteIndex
                - XML_GetCurrentColumnNumber
                - XML_GetCurrentLineNumber
                - XML_GetInputContext

 Other changes:

   #976 #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
                with Automake that were missing from 2.7.0 release tarballs
   #983 #984  Fix printf format specifiers for 32bit Emscripten
        #992  docs: Promote OpenSSF Best Practices self-certification
        #978  tests/benchmark: Resolve mistaken double close
        #986  Address compiler warnings
   #990 #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
                to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
                for what these numbers do

    Infrastructure:

        #982  CI: Start running Perl XML::Parser integration tests
        #987  CI: Enforce Clang Static Analyzer clean code
        #991  CI: Re-enable warning clang-analyzer-valist.Uninitialized
                for clang-tidy
        #981  CI: Cover compilation with musl
   #983 #984  CI: Cover compilation with 32bit Emscripten
   #976 #977  CI: Protect against fuzzer files missing from future
                release archives

version update to 2.7.0 (CVE-2024-8176 [bsc#1239618]):

• Security fixes:

  #893 #973 CVE-2024-8176 -- Fix crash from chaining a large number of entities caused by stack overflow by resolving use of recursion, for all three uses of entities: - general entities in character data ("<e>&g1;</e>") - general entities in attribute values ("<e k1='&g1;'/>") - parameter entities ("%p1;") Known impact is (reliable and easy) denial of service: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C (Base Score: 7.5, Temporal Score: 7.2) Please note that a layer of compression around XML can significantly reduce the minimum attack payload size.

• Other changes: #935 #937 Autotools: Make generated CMake files look for libexpat.@[email protected] on macOS #925 Autotools: Sync CMake templates with CMake 3.29 #945 #962 #966 CMake: Drop support for CMake <3.13 #942 CMake: Small fuzzing related improvements #921 docs: Add missing documentation of error code XML_ERROR_NOT_STARTED that was introduced with 2.6.4 #941 docs: Document need for C++11 compiler for use from C++ #959 tests/benchmark: Fix a (harmless) TOCTTOU #944 Windows: Fix installer target location of file xmlwf.xml for CMake #953 Windows: Address warning -Wunknown-warning-option about -Wno-pedantic-ms-format from LLVM MinGW #971 Address Cppcheck warnings #969 #970 Mass-migrate links from http:// to https:// #947 #958 .. #974 #975 Document changes since the previous release #974 #975 Version info bumped from 11:0:10 (libexpat*.so.1.10.0) to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/ for what these numbers do

• no source changes, just adding jira reference: jsc#SLE-21253

Version update to 2.6.4

• Security fixes: [bsc#1232601][bsc#1232579] #915 CVE-2024-50602 -- Fix crash within function XML_ResumeParser from a NULL pointer dereference by disallowing function …

This update for mozjs52 fixes the following issues:

• CVE-2024-45491: Fixed integer overflow in dtdCopy (bsc#1230037)
• CVE-2024-50602: Fixed DoS via XML_ResumeParser (bsc#1232599)
• CVE-2024-45492: Fixed integer overflow in function nextScaffoldPart (bsc#1230038)
• CVE-2024-45490: Fixed negative len for XML_ParseBuffer (bsc#1230036)