{"id":"CVE-2024-45490","aliases":["ALPINE-CVE-2024-45490","ALSA-2024:6754","ALSA-2024:6989","AZL-48369","AZL-48372","BELL-CVE-2024-45490","CLSA-2024-1725650114","CLSA-2024-1726163032","CLSA-2024-1726163048","CLSA-2024-1726163202","CLSA-2024-1726608591","CLSA-2025-1761902260","DEBIAN-CVE-2024-45490","DLA-3893-1","DSA-5770-1","EUVD-2024-41509","GHSA-4hvh-m426-wv8w","JLSEC-2025-62","MGASA-2024-0294","MGASA-2024-0338","OESA-2024-2102","OESA-2024-2138","RHSA-2024:6754","RHSA-2024:6989","RLSA-2024:6754","RLSA-2024:6989","SUSE-SU-2024:3182-1","SUSE-SU-2024:3216-1","SUSE-SU-2024:3515-1","SUSE-SU-2024:3538-1","SUSE-SU-2024:3554-1","SUSE-SU-2025:20045-1","SUSE-SU-2025:20207-1","SUSE-SU-2025:20311-1","SUSE-SU-2025:4512-1","SUSE-SU-2026:0044-1","UBUNTU-CVE-2024-45490","USN-7000-1","USN-7000-2","USN-7001-1","USN-7001-2","openSUSE-SU-2024:14322-1","openSUSE-SU-2024:14328-1","openSUSE-SU-2024:14379-1","openSUSE-SU-2024:14380-1","openSUSE-SU-2024:14381-1"],"status":"published","title":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length...","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01686,"percentile":0.77184,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-190","CWE-611"],"published":"2024-08-30T00:00:00Z","modified":"2026-11-03T06:32:59Z","exploits":[{"source":"pocgithub","id":"jstjep00/CVE-2024-45490-libexpat-poc","title":"jstjep00/CVE-2024-45490-libexpat-poc","date":"2026-10-24","url":"https://github.com/jstjep00/CVE-2024-45490-libexpat-poc"}],"fixes":[{"ecosystem":"Alpine:v3.17","package":"expat","fixed_in":["2.6.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"expat","fixed_in":["2.6.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"expat","fixed_in":["2.6.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"expat","fixed_in":["2.6.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"expat","fixed_in":["2.6.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"expat","fixed_in":["2.6.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"expat","fixed_in":["2.6.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"expat","fixed_in":["2.6.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"qt5-qtwebengine","fixed_in":["5.15.16-r12"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"qt5-qtwebengine","fixed_in":["5.15.17-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"qt5-qtwebengine","fixed_in":["5.15.17-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"qt5-qtwebengine","fixed_in":["5.15.17-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"qt6-qtwebengine","fixed_in":["6.7.2-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"qt6-qtwebengine","fixed_in":["6.7.2-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"qt6-qtwebengine","fixed_in":["6.7.2-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"qt6-qtwebengine","fixed_in":["6.7.2-r6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"expat","fixed_in":["2.6.3-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"expat","fixed_in":["2.6.3-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"expat","fixed_in":["2.6.3-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"expat","fixed_in":["2.6.3-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"expat","fixed_in":["2.6.3-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"expat","fixed_in":["2.6.3-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"expat","fixed_in":["2.2.6-2+deb10u7+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libexpat1","fixed_in":["2.2.6-2+deb10u7+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libexpat1-dev","fixed_in":["2.2.6-2+deb10u7+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"expat","fixed_in":["2.5.0-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.6.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.6.2-2"],"sources":["osv"]},{"ecosystem":"Julia","package":"Expat_jll","fixed_in":["2.6.4+0"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"expat","fixed_in":["2.2.9-13.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"expat","fixed_in":["2.4.1-12.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"expat","fixed_in":["2.5.0-4.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"expat","fixed_in":["2.4.1-12.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"expat","fixed_in":["2.4.1-12.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","fixed_in":["2.1.0-4ubuntu1.4+esm9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","fixed_in":["2.1.0-7ubuntu0.16.04.5+esm9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxmltok","fixed_in":["1.2-3ubuntu0.16.04.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","fixed_in":["2.2.5-3ubuntu0.9+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxmltok","fixed_in":["1.2-4ubuntu0.18.04.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"expat","fixed_in":["2.2.9-1ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxmltok","fixed_in":["1.2-4ubuntu0.20.04.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"expat","fixed_in":["2.4.7-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libxmltok","fixed_in":["1.2-4ubuntu0.22.04.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"expat","fixed_in":["2.6.1-2ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libxmltok","fixed_in":["1.2-4.1ubuntu2.24.0.4.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.16-r12"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.17-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.17-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.17-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"qt6-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.2-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"qt6-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.2-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"qt6-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.2-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"qt6-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.2-r6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-2.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-2.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-15.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-15.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Azure Linux:3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.2-r0"},{"fixed":"2.6.3-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.2-r0"},{"fixed":"2.6.3-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.2-r0"},{"fixed":"2.6.3-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.2-r0"},{"fixed":"2.6.3-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.el7_9.tuxcare.els2"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libexpat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libexpat1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1+deb12u1"}]}],"versions":["2.5.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4.1","1.2-4.1~exp1","1.2-4.2"]},{"source":"osv","ecosystem":"Debian:11","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u6"}]}],"versions":["2.2.10-2","2.2.10-2+deb11u1","2.2.10-2+deb11u2","2.2.10-2+deb11u3","2.2.10-2+deb11u4","2.2.10-2+deb11u5"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1+deb12u1"}]}],"versions":["2.5.0-1"],"bundled":3},{"source":"osv","ecosystem":"Julia","package":"Expat_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-7.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-13.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-12.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-4.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-12.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-12.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51.08-3.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51.06-2.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51.08-3.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.59.02-2.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51.08-3.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-15.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-15.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-15.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-15.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-15.el8_10"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.37.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.37.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.37.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.22.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.30.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.4.0-150600.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.4.0-150600.3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-150400.3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-150400.3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-150400.3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-150400.3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-150400.3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-slfo.1.1_1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.6.0-150000.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.6.0-150000.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"mozjs60","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-150200.6.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"mozjs60","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-150200.6.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"mozjs60","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-150200.6.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"mozjs60","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-150200.6.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"mozjs60","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-150200.6.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"mozjs60","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-150200.6.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm9"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4","2.1.0-4ubuntu1.4+esm6","2.1.0-4ubuntu1.4+esm7","2.1.0-4ubuntu1.4+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50-3","3.1.4~abc9f50-4","3.1.4~abc9f50-4ubuntu2","3.1.4~abc9f50-4ubuntu2+esm1","3.1.4~abc9f50-4ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37ubuntu5","4.1.1+xorg4.3.0-37ubuntu5.0.1","4.1.1+xorg4.3.0-37ubuntu5.0.2","4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14ubuntu1","5.8.0-14ubuntu3","5.8.0-14.1ubuntu2","5.8.0-14.1ubuntu3","5.8.0-14.1ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.33-3.2ubuntu3","1.33.06-0ubuntu1","1.33.06-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm9"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2","2.1.0-7ubuntu0.16.04.5+esm5","2.1.0-7ubuntu0.16.04.5+esm6","2.1.0-7ubuntu0.16.04.5+esm7","2.1.0-7ubuntu0.16.04.5+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-3ubuntu0.16.04.1~esm4"}]}],"versions":["1.2-3build3","1.2-3ubuntu0.16.04.1~esm1","1.2-3ubuntu0.16.04.1~esm2","1.2-3ubuntu0.16.04.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ayttm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.3-3build1","0.6.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cableswig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0+git20150808-1","0.1.0+git20150808-2","0.1.0+git20150808-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.4-4","2.4.4-4build1","2.4.4-4ubuntu1","2.6.1-3","2.6.2-1","2.6.2-2","2.6.2-3","2.6.3-1","2.6.3-1ubuntu1","2.6.3-2ubuntu1","2.6.3-3ubuntu1","2.6.3-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1ubuntu3","4.8.1-1ubuntu4","4.8.2-3.1ubuntu1","4.9.0-3ubuntu2","4.9.0-4ubuntu1","4.9.0-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-4","2.4.7-4build1","2.4.7-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2","4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.1+dfsg-2","5.10.1+dfsg-2build3","5.10.1+dfsg-2.1build1","5.10.1+dfsg-2.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-0.2ubuntu3","1.33.14-1ubuntu1","1.33.14-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+esm1"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7","2.2.5-3ubuntu0.8","2.2.5-3ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-2","3.1.4~abc9f50+dfsg2-1","3.1.4~abc9f50+dfsg3-1","3.1.4~abc9f50+dfsg3-2","3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-3build1","2.8.3-1","2.8.4-1","2.8.4-1build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.18.04.1~esm3"}]}],"versions":["1.2-4","1.2-4ubuntu0.18.04.1~esm1","1.2-4ubuntu0.18.04.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5build1","0.13+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-5ubuntu1","2.4.7-5ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1","0.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-7","1.33.14-8","1.33.14-8build1","1.33.14-8ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.7"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4","2.2.9-1ubuntu0.5","2.2.9-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-4.1ubuntu1","4.13.2-dfsg1-1ubuntu1","4.13.2-dfsg1-4ubuntu1","4.13.2-dfsg1-6","4.13.2-dfsg1-6ubuntu1","4.13.2-dfsg1-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.20.04.1~esm3"}]}],"versions":["1.2-4","1.2-4ubuntu0.20.04.1~esm1","1.2-4ubuntu0.20.04.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-6","0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build1","2.4.7-6build2","2.4.7-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-8build1","1.33.14-8build2","1.33.14-8ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.4"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1","2.4.7-1ubuntu0.2","2.4.7-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.3withdata-dfsg1-4.1","4.13.3withdata-dfsg2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1","0.11.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.22.04.1~esm3"}]}],"versions":["1.2-4","1.2-4ubuntu0.22.04.1~esm1","1.2-4ubuntu0.22.04.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build3","2.4.7-6.1","2.4.7-6.1build1","2.4.7-6.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-9","1.33.14-10","1.33.14-10ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24+dfsg-2","0.24+dfsg-3","0.24+dfsg-3build1","0.24+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2ubuntu0.1"}]}],"versions":["2.5.0-2","2.6.0-1","2.6.1-2","2.6.1-2build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1","0.13+ds2-1build1","0.13+ds2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.3-1","0.9.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.8+dfsg-3","0.11.8+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4.1ubuntu2.24.0.4.1+esm1"}]}],"versions":["1.2-4ubuntu1","1.2-4.1ubuntu1","1.2-4.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.2","2.4.7-6.2build1","2.4.7-6.2build2","2.4.7-6.2build3","2.4.7-6.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-11","1.33.14-11.1","1.33.14-12","1.33.14-12build1","1.33.14-12build2","1.33.14-12ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.3","2.4.7-6.3build1","2.4.7-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-2","0.9.5.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-7","1.59.03-9","1.59.03-10","1.59.03-10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7.1","2.4.7-7.2","2.4.7-7.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-2","0.9.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-3","0.11.10+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.05-1","1.60.05-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2","0.28+dfsg-1","0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2","0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-3","0.9.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2","0.11.10+dfsg-2build1","0.11.10+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-10.1","1.60.05-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7","2.4.7-7.1","2.4.7-7.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm9"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4","2.1.0-4ubuntu1.4+esm6","2.1.0-4ubuntu1.4+esm7","2.1.0-4ubuntu1.4+esm8"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm9"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2","2.1.0-7ubuntu0.16.04.5+esm5","2.1.0-7ubuntu0.16.04.5+esm6","2.1.0-7ubuntu0.16.04.5+esm7","2.1.0-7ubuntu0.16.04.5+esm8"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+esm1"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7","2.2.5-3ubuntu0.8","2.2.5-3ubuntu0.9"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.7"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4","2.2.9-1ubuntu0.5","2.2.9-1ubuntu0.6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2ubuntu0.1"}]}],"versions":["2.5.0-2","2.6.0-1","2.6.1-2","2.6.1-2build1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.4"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1","2.4.7-1ubuntu0.2","2.4.7-1ubuntu0.3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-3ubuntu0.16.04.1~esm4"}]}],"versions":["1.2-3build3","1.2-3ubuntu0.16.04.1~esm1","1.2-3ubuntu0.16.04.1~esm2","1.2-3ubuntu0.16.04.1~esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.18.04.1~esm3"}]}],"versions":["1.2-4","1.2-4ubuntu0.18.04.1~esm1","1.2-4ubuntu0.18.04.1~esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.20.04.1~esm3"}]}],"versions":["1.2-4","1.2-4ubuntu0.20.04.1~esm1","1.2-4ubuntu0.20.04.1~esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.22.04.1~esm3"}]}],"versions":["1.2-4","1.2-4ubuntu0.22.04.1~esm1","1.2-4ubuntu0.22.04.1~esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4.1ubuntu2.24.0.4.1+esm1"}]}],"versions":["1.2-4ubuntu1","1.2-4.1ubuntu1","1.2-4.1ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"x3270","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.4.0-5.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.2.0-2.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-5.1"}]}],"bundled":3}],"products":[{"vendor":"libexpat_project","product":"libexpat"},{"vendor":"siemens","product":"ruggedcom rst2428p"},{"vendor":"siemens","product":"scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family"},{"vendor":"siemens","product":"scalance xcm-/xrm-/xch-/xrh-300 family"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://github.com/libexpat/libexpat/pull/890","tags":["Patch","fix","web","article","report"]},{"url":"https://github.com/libexpat/libexpat/issues/887","tags":["Issue Tracking","report","web","article"]},{"url":"https://security.netapp.com/advisory/ntap-20241018-0004/","tags":["advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2024/Dec/12","tags":["web"]},{"url":"http://seclists.org/fulldisclosure/2024/Dec/10","tags":["web"]},{"url":"http://seclists.org/fulldisclosure/2024/Dec/8","tags":["web"]},{"url":"http://seclists.org/fulldisclosure/2024/Dec/7","tags":["web"]},{"url":"http://seclists.org/fulldisclosure/2024/Dec/6","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-613116.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45490","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241018-0004"},{"url":"https://github.com/advisories/GHSA-4hvh-m426-wv8w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-45490","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6754","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-45490","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-45491","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-45492","tags":["report"]},{"url":"https://bugzilla.redhat.com/2308615","tags":["report"]},{"url":"https://bugzilla.redhat.com/2308616","tags":["report"]},{"url":"https://bugzilla.redhat.com/2308617","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-6754.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6989","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-6989.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-45490","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-50","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2024-1725650114.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2024-1726163032.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2024-1726163048.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos8stream-els/CLSA-2024-1726163202.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1726608591.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2025-1761902260.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45490.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-45490","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0294.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33547","tags":["report"]},{"url":"http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2024\u0026m=slackware-security.351556","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2024-0338.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33630","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/NII5WWMANSN5NYNMNOK7LJ2P5FT7TW5X/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2102","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2138","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45491","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2308615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2308616","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2308617","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6754.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45490","tags":["advisory","report"]},{"url":"https://github.com/libexpat/libexpat/blob/R_2_6_3/expat/Changes","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45491","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/888","tags":["article"]},{"url":"https://github.com/libexpat/libexpat/pull/891","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45492","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45492","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/889","tags":["article"]},{"url":"https://github.com/libexpat/libexpat/pull/892","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6989.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:6754","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:6989","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243182-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1229930","tags":["report"]},{"url":"https://bugzilla.suse.com/1229931","tags":["report"]},{"url":"https://bugzilla.suse.com/1229932","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45492","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243216-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243515-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243538-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230036","tags":["report"]},{"url":"https://bugzilla.suse.com/1230037","tags":["report"]},{"url":"https://bugzilla.suse.com/1230038","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243554-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520045-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221289","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28757","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520207-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219559","tags":["report"]},{"url":"https://bugzilla.suse.com/1219561","tags":["report"]},{"url":"https://bugzilla.suse.com/1232579","tags":["report"]},{"url":"https://bugzilla.suse.com/1232601","tags":["report"]},{"url":"https://bugzilla.suse.com/1239618","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8176","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520311-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254512-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232599","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260044-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45490","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7000-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7001-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7001-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7000-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-45491","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-45492","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NTUXDK3N23TI6WAE5SOEDJKD7NIASPBG/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TAIATV7O5IGNWF5QEG55GA3DNAVFOJWG/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WR4SNIPTL3MVBAVRYUOIK4QCPYAXEF3S/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-45490","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.","status":"published","published":"2024-08-30T00:00:00Z","modified":"2026-10-15T00:50:04.079Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:34:08.16279Z"}],"euvd":[{"id":"EUVD-2024-41509","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.","status":"published","published":"2024-08-30T00:00:00Z","modified":"2026-10-15T00:50:04Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:09.222448Z"}],"ghsa":[{"id":"GHSA-4hvh-m426-wv8w","title":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length...","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.","status":"published","published":"2024-08-30T03:30:44Z","modified":"2026-05-12T12:33:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190","CWE-611"],"updated_at":"2026-11-02T15:08:03.349738Z"}],"nvd":[{"id":"CVE-2024-45490","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.","status":"published","published":"2024-08-30T03:15:03.757Z","modified":"2026-06-17T07:54:18.503Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-611","CWE-190"],"updated_at":"2026-11-02T14:10:21.771404Z"}],"osv":[{"id":"ALPINE-CVE-2024-45490","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.","status":"published","published":"2024-08-30T03:15:03.757Z","modified":"2026-11-03T06:32:59.963276472Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"AZL-48369","title":"CVE-2024-45490 affecting package expat for versions less than 2.6.3-1","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.","status":"published","published":"2024-08-30T03:15:03Z","modified":"2026-04-21T04:49:50.225511Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-48372","title":"CVE-2024-45490 affecting package expat for versions less than 2.6.3-1","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.","status":"published","published":"2024-08-30T03:15:03Z","modified":"2026-04-21T04:33:00.091042Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"BELL-CVE-2024-45490","status":"published","published":"2024-08-31T05:57:00.100546Z","modified":"2026-01-26T09:37:56.641276Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:20.452786Z"},{"id":"CVE-2024-45490","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.","status":"published","published":"2024-08-30T00:00:00Z","modified":"2026-10-28T02:30:59.852220451Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:42.790566Z"},{"id":"DEBIAN-CVE-2024-45490","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.","status":"published","published":"2024-08-30T03:15:03.757Z","modified":"2026-11-02T12:02:49.267001856Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.473331Z"},{"id":"JLSEC-2025-62","title":"An issue was discovered in libexpat before 2.6.3","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for `XML_ParseBuffer`.","status":"published","published":"2025-10-14T15:35:41.198Z","modified":"2026-07-25T18:23:44.490138384Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2024-2102","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\n\nSecurity Fix(es):\n\nAn issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.(CVE-2024-45490)","status":"published","published":"2024-09-06T11:07:34Z","modified":"2026-08-18T01:18:36.559159184Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2138","title":"xmlrpc-c security update","description":"XML-RPC is a quick-and-easy way to make procedure calls over the Internet. It converts the procedure call into an XML document, sends it to a remote server using HTTP, and gets back the response as XML.\n\nSecurity Fix(es):\n\nAn issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.(CVE-2024-45490)\n\nAn issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).(CVE-2024-45491)","status":"published","published":"2024-09-14T11:07:36Z","modified":"2026-08-18T01:17:33.653685143Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHSA-2024:6754","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-27T14:08:34Z","modified":"2026-10-15T10:08:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:6989","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-27T14:09:23Z","modified":"2026-10-15T10:08:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"UBUNTU-CVE-2024-45490","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.","status":"published","published":"2024-08-30T03:15:00Z","modified":"2026-10-17T12:56:39.441349712Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"ALSA-2024:6754","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)\n* libexpat: Integer Overflow or Wraparound (CVE-2024-45491)\n* libexpat: integer overflow (CVE-2024-45492)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-18T00:00:00Z","modified":"2026-10-29T11:32:03.42289457Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:6989","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)\n* libexpat: Integer Overflow or Wraparound (CVE-2024-45491)\n* libexpat: integer overflow (CVE-2024-45492)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-24T00:00:00Z","modified":"2026-10-29T11:02:21.886887171Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"CLSA-2024-1725650114","title":"expat: Fix of 3 CVEs","description":"- CVE-2024-45490: reject negative length in XML_ParseBuffer\n- CVE-2024-45491: detect integer overflow in dtdCopy on 32-bit platforms\n- CVE-2024-45492: detect integer overflow in nextScaffoldPart on 32-bit platforms","status":"published","published":"2024-09-06T19:15:18Z","modified":"2026-06-01T00:30:04.416563383Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1726163032","title":"expat: Fix of 3 CVEs","description":"- The release version was raised because it corresponds to version 13\n- CVE-2024-45490: reject negative len for XML_ParseBuffer to prevent\n improper restriction of XML External Entity Reference\n- CVE-2024-45491: prevent integer overflow in dtdCopy\n- CVE-2024-45492: prevent integer overflow in nextScaffoldPart","status":"published","published":"2024-09-12T17:43:54Z","modified":"2026-06-01T00:33:20.629196914Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1726163048","title":"expat: Fix of 3 CVEs","description":"- The release version was raised because it corresponds to version 13\n- CVE-2024-45490: reject negative len for XML_ParseBuffer to prevent\n improper restriction of XML External Entity Reference\n- CVE-2024-45491: prevent integer overflow in dtdCopy\n- CVE-2024-45492: prevent integer overflow in nextScaffoldPart","status":"published","published":"2024-09-12T17:44:11Z","modified":"2026-06-01T00:33:22.749807116Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1726163202","title":"expat: Fix of 3 CVEs","description":"- The release version was raised because it corresponds to version 13\n- CVE-2024-45490: reject negative len for XML_ParseBuffer to prevent\n improper restriction of XML External Entity Reference\n- CVE-2024-45491: prevent integer overflow in dtdCopy\n- CVE-2024-45492: prevent integer overflow in nextScaffoldPart","status":"published","published":"2024-09-12T17:46:46Z","modified":"2026-06-01T00:32:55.665071692Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1726608591","title":"expat: Fix of 3 CVEs","description":"- CVE-2024-45490: Reject negative length for XML_ParseBuffer in xmlparse.c\n- CVE-2024-45491: Detect integer overflow in dtdCopy on 32-bit platforms\n- CVE-2024-45492: Detect integer overflow in nextScaffoldPart on 32-bit platforms","status":"published","published":"2024-09-17T21:29:54Z","modified":"2026-06-01T00:33:05.361269481Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1761902260","title":"Fix CVE(s): CVE-2024-45490","description":" * SECURITY UPDATE: Improper restriction of XML External Entity Reference\n - debian/patches/CVE-2024-45490.patch: Reject negative len for\n XML_ParseBuffer\n - CVE-2024-45490","status":"published","published":"2025-10-31T09:17:47Z","modified":"2026-06-04T10:03:49.953265Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DLA-3893-1","title":"expat - security update","status":"published","published":"2024-09-19T00:00:00Z","modified":"2026-03-09T01:20:14.259348Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5770-1","title":"expat - security update","status":"published","published":"2024-09-17T00:00:00Z","modified":"2026-03-09T02:08:46.361951Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0294","title":"Updated expat packages fix security vulnerabilities","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not\nreject a negative length for XML_ParseBuffer. (CVE-2024-45490)\nAn issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c\ncan have an integer overflow for nDefaultAtts on 32-bit platforms (where\nUINT_MAX equals SIZE_MAX). (CVE-2024-45491)\nAn issue was discovered in libexpat before 2.6.3. nextScaffoldPart in\nxmlparse.c can have an integer overflow for m_groupSize on 32-bit\nplatforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)\n","status":"published","published":"2024-09-11T20:42:44Z","modified":"2026-04-16T04:42:23.210133737Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"MGASA-2024-0338","title":"Updated mozjs78 packages fix security vulnerabilities","description":"An issue was discovered in libexpat before 2.6.3. xmlparse.c does not\nreject a negative length for XML_ParseBuffer. (CVE-2024-45490)\nAn issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c\ncan have an integer overflow for nDefaultAtts on 32-bit platforms (where\nUINT_MAX equals SIZE_MAX). (CVE-2024-45491)\nAn issue was discovered in libexpat before 2.6.3. nextScaffoldPart in\nxmlparse.c can have an integer overflow for m_groupSize on 32-bit\nplatforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)\n","status":"published","published":"2024-10-27T02:37:06Z","modified":"2026-04-16T04:44:43.027594203Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14322-1","title":"expat-2.6.3-1.1 on GA media","description":"These are all security issues fixed in the expat-2.6.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-09-06T00:00:00Z","modified":"2026-02-04T03:03:51.970242Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14328-1","title":"x3270-4.3-4.1 on GA media","description":"These are all security issues fixed in the x3270-4.3-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-09-09T00:00:00Z","modified":"2026-02-04T03:31:17.647852Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14379-1","title":"libmozjs-115-0-115.4.0-5.1 on GA media","description":"These are all security issues fixed in the libmozjs-115-0-115.4.0-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-02T00:00:00Z","modified":"2026-02-04T02:58:49.124611Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14380-1","title":"libmozjs-128-0-128.2.0-2.1 on GA media","description":"These are all security issues fixed in the libmozjs-128-0-128.2.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-02T00:00:00Z","modified":"2026-02-04T04:25:03.767545Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14381-1","title":"libmozjs-78-0-78.15.0-5.1 on GA media","description":"These are all security issues fixed in the libmozjs-78-0-78.15.0-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-02T00:00:00Z","modified":"2025-05-07T18:16:17.105236Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"RLSA-2024:6754","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)\n\n* libexpat: Integer Overflow or Wraparound (CVE-2024-45491)\n\n* libexpat: integer overflow (CVE-2024-45492)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-30T14:31:38.136782Z","modified":"2026-02-04T14:45:04.61255Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:6989","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)\n\n* libexpat: Integer Overflow or Wraparound (CVE-2024-45491)\n\n* libexpat: integer overflow (CVE-2024-45492)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-30T14:30:24.512095Z","modified":"2026-02-05T11:15:04.395706Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:3182-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2024-45492: Detect integer overflow in function nextScaffoldPart. (bsc#1229932)\n- CVE-2024-45491: Detect integer overflow in dtdCopy. (bsc#1229931)\n- CVE-2024-45490: Reject negative len for XML_ParseBuffer. (bsc#1229930)\n","status":"published","published":"2024-09-09T14:41:45Z","modified":"2026-02-04T02:37:39.550105Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3216-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2024-45492: integer overflow in function nextScaffoldPart. (bsc#1229932)\n- CVE-2024-45491: integer overflow in dtdCopy. (bsc#1229931)\n- CVE-2024-45490: negative length for XML_ParseBuffer not rejected. (bsc#1229930)\n","status":"published","published":"2024-09-12T11:05:47Z","modified":"2026-02-04T02:52:49.911233Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3515-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2024-45492: integer overflow in function nextScaffoldPart. (bsc#1229932)\n- CVE-2024-45491: integer overflow in dtdCopy. (bsc#1229931)\n- CVE-2024-45490: negative length for XML_ParseBuffer not rejected. (bsc#1229930)\n","status":"published","published":"2024-10-03T11:33:36Z","modified":"2026-02-04T02:27:46.584291Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3538-1","title":"Security update for mozjs115","description":"This update for mozjs115 fixes the following issues:\n\n- CVE-2024-45490: Fixed negative len for XML_ParseBuffer in embedded expat (bnc#1230036)\n- CVE-2024-45491: Fixed integer overflow in dtdCopy in embedded expat (bnc#1230037)\n- CVE-2024-45492: Fixed integer overflow in function nextScaffoldPart in embedded expat (bnc#1230038)\n","status":"published","published":"2024-10-07T12:16:34Z","modified":"2026-02-04T03:18:03.031506Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3554-1","title":"Security update for mozjs78","description":"This update for mozjs78 fixes the following issues:\n\n- CVE-2024-45490: Fixed negative len for XML_ParseBuffer in embedded expat (bnc#1230036)\n- CVE-2024-45491: Fixed integer overflow in dtdCopy in embedded expat (bnc#1230037)\n- CVE-2024-45492: Fixed integer overflow in function nextScaffoldPart in embedded expat (bnc#1230038)\n","status":"published","published":"2024-10-09T06:17:10Z","modified":"2026-02-04T03:18:56.516033Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2025:20045-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2024-45492: detect integer overflow in function nextScaffoldPart (bsc#1229932) \n- CVE-2024-45491: detect integer overflow in dtdCopy (bsc#1229931)\n- CVE-2024-45490: reject negative len for XML_ParseBuffer (bsc#1229930)\n- CVE-2024-28757: XML Entity Expansion attack when there is isolated use of external parsers (bsc#1221289) \n","status":"published","published":"2025-02-03T08:54:55Z","modified":"2026-03-23T04:50:41.184265Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20207-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\nVersion update to 2.7.1:\n\n* Bug fixes:\n\n * Restore event pointer behavior from Expat 2.6.4 (that the fix to CVE-2024-8176 changed in 2.7.0);\n affected API functions are:\n\n - XML_GetCurrentByteCount\n - XML_GetCurrentByteIndex\n - XML_GetCurrentColumnNumber\n - XML_GetCurrentLineNumber\n - XML_GetInputContext\n\n * Other changes:\n #976 #977 Autotools: Integrate files \"fuzz/xml_lpm_fuzzer.{cpp,proto}\"\n with Automake that were missing from 2.7.0 release tarballs\n #983 #984 Fix printf format specifiers for 32bit Emscripten\n #992 docs: Promote OpenSSF Best Practices self-certification\n #978 tests/benchmark: Resolve mistaken double close\n #986 Address compiler warnings\n #990 #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1)\n to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/\n for what these numbers do\n\n Infrastructure:\n #982 CI: Start running Perl XML::Parser integration tests\n #987 CI: Enforce Clang Static Analyzer clean code\n #991 CI: Re-enable warning clang-analyzer-valist.Uninitialized\n for clang-tidy\n #981 CI: Cover compilation with musl\n #983 #984 CI: Cover compilation with 32bit Emscripten\n #976 #977 CI: Protect against fuzzer files missing from future\n release archives\n\nVersion update to 2.7.0 (CVE-2024-8176 [bsc#1239618])\n\n* Security fixes:\n * CVE-2024-8176 -- Fix crash from chaining a large number\n of entities caused by stack overflow by resolving use of\n recursion, for all three uses of entities:\n - general entities in character data (\"\u003ce\u003e\u0026g1;\u003c/e\u003e\")\n - general entities in attribute values (\"\u003ce k1='\u0026g1;'/\u003e\")\n - parameter entities (\"%p1;\")\n\n Known impact is (reliable and easy) denial of service:\n\n CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C\n\n (Base Score: 7.5, Temporal Score: 7.2)\n\n Please note that a layer of compression around XML can\n significantly reduce the minimum attack payload size.\n\n * Other changes:\n * Document changes since the previous release\n * Version info bumped from 11:0:10 (libexpat*.so.1.10.0)\n to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/\n for what these numbers do\n\nVersion update to 2.6.4:\n\n * Security fixes: [bsc#1232601][bsc#1232579]\n * CVE-2024-50602 -- Fix crash within function XML_ResumeParser\n from a NULL pointer dereference by disallowing function\n XML_StopParser to (stop or) suspend an unstarted parser.\n A new error code XML_ERROR_NOT_STARTED was introduced to\n properly communicate this situation. // CWE-476 CWE-754\n * Other changes:\n * Version info bumped from 10:3:9 (libexpat*.so.1.9.3)\n to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/\n for what these numbers do\n\nUpdate to 2.6.3:\n\n * Security fixes:\n - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with\n len \u003c 0 without noticing and then calling XML_GetBuffer\n will have XML_ParseBuffer fail to recognize the problem\n and XML_GetBuffer corrupt memory.\n With the fix, XML_ParseBuffer now complains with error\n XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse\n has been doing since Expat 2.2.1, and now documented.\n Impact is denial of service to potentially artitrary code\n execution.\n - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an\n integer overflow for nDefaultAtts on 32-bit platforms\n (where UINT_MAX equals SIZE_MAX).\n Impact is denial of service to potentially artitrary code\n execution.\n - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can\n have an integer overflow for m_groupSize on 32-bit\n platforms (where UINT_MAX equals SIZE_MAX).\n Impact is denial of service to potentially artitrary code\n execution.\n\n * Other changes:\n\n - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)\n to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/\n for what these numbers do \n\nUpdate to 2.6.2:\n\n * CVE-2024-28757 -- Prevent billion laughs attacks with isolated\n use of external parsers (bsc#1221289)\n * Reject direct parameter entity recursion and avoid the related\n undefined behavior\n\nUpdate to 2.6.1:\n\n * Expose billion laughs API with XML_DTD defined and XML_GE\n undefined, regression from 2.6.0\n * Make tests independent of CPU speed, and thus more robust\n\nUpdate to 2.6.0: \n\n * Security fixes:\n - CVE-2023-52425 (bsc#1219559) \n Fix quadratic runtime issues with big tokens\n that can cause denial of service, in partial where\n dealing with compressed XML input. Applications\n that parsed a document in one go -- a single call to\n functions XML_Parse or XML_ParseBuffer -- were not affected.\n The smaller the chunks/buffers you use for parsing\n previously, the bigger the problem prior to the fix.\n Backporters should be careful to no omit parts of\n pull request #789 and to include earlier pull request #771,\n in order to not break the fix.\n - CVE-2023-52426 (bsc#1219561)\n Fix billion laughs attacks for users\n compiling *without* XML_DTD defined (which is not common).\n Users with XML_DTD defined have been protected since\n Expat \u003e=2.4.0 (and that was CVE-2013-0340 back then).\n * Bug fixes:\n - Fix parse-size-dependent \"invalid token\" error for\n external entities that start with a byte order mark\n - Fix NULL pointer dereference in setContext via\n XML_ExternalEntityParserCreate for compilation with\n XML_DTD undefined\n - Protect against closing entities out of order\n * Other changes:\n - Improve support for arc4random/arc4random_buf\n - Improve buffer growth in XML_GetBuffer and XML_Parse\n - xmlwf: Support --help and --version\n - xmlwf: Support custom buffer size for XML_GetBuffer and read\n - xmlwf: Improve language and URL clickability in help output\n - examples: Add new example \"element_declarations.c\"\n - Be stricter about macro XML_CONTEXT_BYTES at build time\n - Make inclusion to expat_config.h consistent\n - Autotools: configure.ac: Support --disable-maintainer-mode\n - Autotools: Sync CMake templates with CMake 3.26\n - Autotools: Make installation of shipped man page doc/xmlwf.1\n independent of docbook2man availability\n - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file\n section \"Cflags.private\" in order to fix compilation\n against static libexpat using pkg-config on Windows\n - Autotools|CMake: Require a C99 compiler\n (a de-facto requirement already since Expat 2.2.2 of 2017)\n - Autotools|CMake: Fix PACKAGE_BUGREPORT variable\n - Autotools|CMake: Make test suite require a C++11 compiler\n - CMake: Require CMake \u003e=3.5.0\n - CMake: Lowercase off_t and size_t to help a bug in Meson\n - CMake: Sort xmlwf sources alphabetically\n - CMake|Windows: Fix generation of DLL file version info\n - CMake: Build tests/benchmark/benchmark.c as well for\n a build with -DEXPAT_BUILD_TESTS=ON\n - docs: Document the importance of isFinal + adjust tests\n accordingly\n - docs: Improve use of \"NULL\" and \"null\"\n - docs: Be specific about version of XML (XML 1.0r4)\n and version of C (C99); (XML 1.0r5 will need a sponsor.)\n - docs: reference.html: Promote function XML_ParseBuffer more\n - docs: reference.html: Add HTML anchors to XML_* macros\n - docs: reference.html: Upgrade to OK.css 1.2.0\n - docs: Fix typos\n - docs|CI: Use HTTPS URLs instead of HTTP at various places\n - Address compiler warnings\n - Address clang-tidy warnings\n - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)\n to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/\n for what these numbers do\n","status":"published","published":"2025-04-29T11:07:45Z","modified":"2026-03-23T04:50:04.767104Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20311-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\nVersion update to 2.7.1:\n\n Bug fixes:\n\n #980 #989 Restore event pointer behavior from Expat 2.6.4\n (that the fix to CVE-2024-8176 changed in 2.7.0);\n affected API functions are:\n - XML_GetCurrentByteCount\n - XML_GetCurrentByteIndex\n - XML_GetCurrentColumnNumber\n - XML_GetCurrentLineNumber\n - XML_GetInputContext\n\n Other changes:\n\n #976 #977 Autotools: Integrate files \"fuzz/xml_lpm_fuzzer.{cpp,proto}\"\n with Automake that were missing from 2.7.0 release tarballs\n #983 #984 Fix printf format specifiers for 32bit Emscripten\n #992 docs: Promote OpenSSF Best Practices self-certification\n #978 tests/benchmark: Resolve mistaken double close\n #986 Address compiler warnings\n #990 #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1)\n to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/\n for what these numbers do\n\n Infrastructure:\n\n #982 CI: Start running Perl XML::Parser integration tests\n #987 CI: Enforce Clang Static Analyzer clean code\n #991 CI: Re-enable warning clang-analyzer-valist.Uninitialized\n for clang-tidy\n #981 CI: Cover compilation with musl\n #983 #984 CI: Cover compilation with 32bit Emscripten\n #976 #977 CI: Protect against fuzzer files missing from future\n release archives\n\nversion update to 2.7.0 (CVE-2024-8176 [bsc#1239618]):\n\n * Security fixes:\n\n #893 #973 CVE-2024-8176 -- Fix crash from chaining a large number\n of entities caused by stack overflow by resolving use of\n recursion, for all three uses of entities:\n - general entities in character data (\"\u003ce\u003e\u0026g1;\u003c/e\u003e\")\n - general entities in attribute values (\"\u003ce k1='\u0026g1;'/\u003e\")\n - parameter entities (\"%p1;\")\n Known impact is (reliable and easy) denial of service:\n CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C\n (Base Score: 7.5, Temporal Score: 7.2)\n Please note that a layer of compression around XML can\n significantly reduce the minimum attack payload size.\n\n * Other changes:\n #935 #937 Autotools: Make generated CMake files look for\n libexpat.@SO_MAJOR@.dylib on macOS\n #925 Autotools: Sync CMake templates with CMake 3.29\n #945 #962 #966 CMake: Drop support for CMake \u003c3.13\n #942 CMake: Small fuzzing related improvements\n #921 docs: Add missing documentation of error code\n XML_ERROR_NOT_STARTED that was introduced with 2.6.4\n #941 docs: Document need for C++11 compiler for use from C++\n #959 tests/benchmark: Fix a (harmless) TOCTTOU\n #944 Windows: Fix installer target location of file xmlwf.xml\n for CMake\n #953 Windows: Address warning -Wunknown-warning-option\n about -Wno-pedantic-ms-format from LLVM MinGW\n #971 Address Cppcheck warnings\n #969 #970 Mass-migrate links from http:// to https://\n #947 #958 ..\n #974 #975 Document changes since the previous release\n #974 #975 Version info bumped from 11:0:10 (libexpat*.so.1.10.0)\n to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/\n for what these numbers do\n\n- no source changes, just adding jira reference: jsc#SLE-21253\n\nVersion update to 2.6.4 \n\n * Security fixes: [bsc#1232601][bsc#1232579]\n #915 CVE-2024-50602 -- Fix crash within function XML_ResumeParser\n from a NULL pointer dereference by disallowing function\n XML_StopParser to (stop or) suspend an unstarted parser.\n A new error code XML_ERROR_NOT_STARTED was introduced to\n properly communicate this situation. // CWE-476 CWE-754\n * Other changes:\n #903 CMake: Add alias target \"expat::expat\"\n #905 docs: Document use via CMake \u003e=3.18 with FetchContent\n and SOURCE_SUBDIR and its consequences\n #902 tests: Reduce use of global parser instance\n #904 tests: Resolve duplicate handler\n #317 #918 tests: Improve tests on doctype closing (ex CVE-2019-15903)\n #914 Fix signedness of format strings\n #919 #920 Version info bumped from 10:3:9 (libexpat*.so.1.9.3)\n to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/\n for what these numbers do\n\nUpdate to 2.6.3: \n\n * Security fixes:\n\n - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with\n len \u003c 0 without noticing and then calling XML_GetBuffer\n will have XML_ParseBuffer fail to recognize the problem\n and XML_GetBuffer corrupt memory.\n With the fix, XML_ParseBuffer now complains with error\n XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse\n has been doing since Expat 2.2.1, and now documented.\n Impact is denial of service to potentially artitrary code\n execution.\n - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an\n integer overflow for nDefaultAtts on 32-bit platforms\n (where UINT_MAX equals SIZE_MAX).\n Impact is denial of service to potentially artitrary code\n execution.\n - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can\n have an integer overflow for m_groupSize on 32-bit\n platforms (where UINT_MAX equals SIZE_MAX).\n Impact is denial of service to potentially artitrary code\n execution.\n\nUpdate to 2.6.2:\n\n * CVE-2024-28757 -- Prevent billion laughs attacks with isolated\n use of external parsers (bsc#1221289)\n * Reject direct parameter entity recursion and avoid the related\n undefined behavior\n\nUpdate to 2.6.1:\n\n * Expose billion laughs API with XML_DTD defined and XML_GE\n undefined, regression from 2.6.0\n * Make tests independent of CPU speed, and thus more robust\n\nUpdate to 2.6.0: \n\n * Security fixes:\n - CVE-2023-52425 (bsc#1219559) \n -- Fix quadratic runtime issues with big tokens\n that can cause denial of service, in partial where\n dealing with compressed XML input. Applications\n that parsed a document in one go -- a single call to\n functions XML_Parse or XML_ParseBuffer -- were not affected.\n The smaller the chunks/buffers you use for parsing\n previously, the bigger the problem prior to the fix.\n Backporters should be careful to no omit parts of\n pull request #789 and to include earlier pull request #771,\n in order to not break the fix.\n - CVE-2023-52426 (bsc#1219561)\n -- Fix billion laughs attacks for users\n compiling *without* XML_DTD defined (which is not common).\n Users with XML_DTD defined have been protected since\n Expat \u003e=2.4.0 (and that was CVE-2013-0340 back then).\n * Bug fixes:\n - Fix parse-size-dependent \"invalid token\" error for\n external entities that start with a byte order mark\n - Fix NULL pointer dereference in setContext via\n XML_ExternalEntityParserCreate for compilation with\n XML_DTD undefined\n - Protect against closing entities out of order\n * Other changes:\n - Improve support for arc4random/arc4random_buf\n - Improve buffer growth in XML_GetBuffer and XML_Parse\n - xmlwf: Support --help and --version\n - xmlwf: Support custom buffer size for XML_GetBuffer and read\n - xmlwf: Improve language and URL clickability in help output\n - examples: Add new example \"element_declarations.c\"\n - Be stricter about macro XML_CONTEXT_BYTES at build time\n - Make inclusion to expat_config.h consistent\n - Autotools: configure.ac: Support --disable-maintainer-mode\n - Autotools: Sync CMake templates with CMake 3.26\n - Autotools: Make installation of shipped man page doc/xmlwf.1\n independent of docbook2man availability\n - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file\n section \"Cflags.private\" in order to fix compilation\n against static libexpat using pkg-config on Windows\n - Autotools|CMake: Require a C99 compiler\n (a de-facto requirement already since Expat 2.2.2 of 2017)\n - Autotools|CMake: Fix PACKAGE_BUGREPORT variable\n - Autotools|CMake: Make test suite require a C++11 compiler\n - CMake: Require CMake \u003e=3.5.0\n - CMake: Lowercase off_t and size_t to help a bug in Meson\n - CMake: Sort xmlwf sources alphabetically\n - CMake|Windows: Fix generation of DLL file version info\n - CMake: Build tests/benchmark/benchmark.c as well for\n a build with -DEXPAT_BUILD_TESTS=ON\n - docs: Document the importance of isFinal + adjust tests\n accordingly\n - docs: Improve use of \"NULL\" and \"null\"\n - docs: Be specific about version of XML (XML 1.0r4)\n and version of C (C99); (XML 1.0r5 will need a sponsor.)\n - docs: reference.html: Promote function XML_ParseBuffer more\n - docs: reference.html: Add HTML anchors to XML_* macros\n - docs: reference.html: Upgrade to OK.css 1.2.0\n - docs: Fix typos\n - docs|CI: Use HTTPS URLs instead of HTTP at various places\n - Address compiler warnings\n - Address clang-tidy warnings\n - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)\n to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/\n for what these numbers do\n","status":"published","published":"2025-05-13T13:37:27Z","modified":"2026-03-23T04:50:06.711026Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:4512-1","title":"Security update for mozjs52","description":"This update for mozjs52 fixes the following issues:\n\n- CVE-2024-45491: Fixed integer overflow in dtdCopy (bsc#1230037)\n- CVE-2024-50602: Fixed DoS via XML_ResumeParser (bsc#1232599)\n- CVE-2024-45492: Fixed integer overflow in function nextScaffoldPart (bsc#1230038)\n- CVE-2024-45490: Fixed negative len for XML_ParseBuffer (bsc#1230036)\n","status":"published","published":"2025-12-23T12:23:19Z","modified":"2026-03-23T04:51:49.879147Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0044-1","title":"Security update for mozjs60","description":"This update for mozjs60 fixes the following issues:\n\n- CVE-2024-45492: embedded expat: detect integer overflow in function nextScaffoldPart (bsc#1230038)\n- CVE-2024-45491: embedded expat: detect integer overflow in dtdCopy (bsc#1230037)\n- CVE-2024-45490: embedded expat: reject negative len for XML_ParseBuffer (bsc#1230036)\n- CVE-2024-50602: libexpat: DoS via XML_ResumeParser (bsc#1232602)\n","status":"published","published":"2026-01-06T16:10:16Z","modified":"2026-02-04T04:37:16.872316Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"USN-7000-1","title":"expat vulnerabilities","description":"Shang-Hung Wan discovered that Expat did not properly handle certain\nfunction calls when a negative input length was provided. An attacker\ncould use this issue to cause a denial of service or possibly execute\narbitrary code. (CVE-2024-45490)\n\nShang-Hung Wan discovered that Expat did not properly handle the\npotential for an integer overflow on 32-bit platforms. An attacker\ncould use this issue to cause a denial of service or possibly execute\narbitrary code. (CVE-2024-45491, CVE-2024-45492)\n","status":"published","published":"2024-09-12T10:01:43Z","modified":"2026-06-29T13:51:16.263178981Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7000-2","title":"expat vulnerabilities","description":"USN-7000-1 fixed vulnerabilities in Expat. This update\nprovides the corresponding updates for Ubuntu 22.04 LTS.\n\nOriginal advisory details:\n\n Shang-Hung Wan discovered that Expat did not properly handle certain\n function calls when a negative input length was provided. An attacker\n could use this issue to cause a denial of service or possibly execute\n arbitrary code. (CVE-2024-45490)\n \n Shang-Hung Wan discovered that Expat did not properly handle the\n potential for an integer overflow on 32-bit platforms. An attacker\n could use this issue to cause a denial of service or possibly execute\n arbitrary code. (CVE-2024-45491, CVE-2024-45492)\n","status":"published","published":"2024-09-17T12:19:18Z","modified":"2026-04-27T17:27:03.951914Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7001-1","title":"libxmltok vulnerabilities","description":"Shang-Hung Wan discovered that Expat, contained within the xmltok library,\ndid not properly handle certain function calls when a negative input length\nwas provided. An attacker could use this issue to cause a denial of service\nor possibly execute arbitrary code. (CVE-2024-45490)\n\nShang-Hung Wan discovered that Expat, contained within the xmltok library,\ndid not properly handle the potential for an integer overflow on 32-bit\nplatforms. An attacker could use this issue to cause a denial of service or\npossibly execute arbitrary code. (CVE-2024-45491)\n","status":"published","published":"2024-09-12T10:20:05Z","modified":"2026-06-25T13:32:28.950551873Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-7001-2","title":"libxmltok vulnerabilities","description":"USN-7001-1 fixed vulnerabilities in xmltol library. This update\nprovides the corresponding updates for Ubuntu 24.04 LTS.\n\nOriginal advisory details:\n\n Shang-Hung Wan discovered that Expat, contained within the xmltok library,\n did not properly handle certain function calls when a negative input\n length was provided. An attacker could use this issue to cause a denial of\n service or possibly execute arbitrary code. (CVE-2024-45490)\n \n Shang-Hung Wan discovered that Expat, contained within the xmltok library,\n did not properly handle the potential for an integer overflow on 32-bit\n platforms. An attacker could use this issue to cause a denial of service\n or possibly execute arbitrary code. (CVE-2024-45491)\n","status":"published","published":"2024-09-17T11:54:23Z","modified":"2026-04-27T17:27:49.636236Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}