Ubuntu 7000-1: Expat Security Advisory Updates
Summary
A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Expat. Software Description: - expat: XML parsing C library Details: Shang-Hung Wan discovered that Expat did not properly handle certain function calls when a negative input length was provided. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2024-45490) Shang-Hung Wan discovered that Expat did properly handle the potential for an integer overflow on 32-bit platforms. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2024-45491, CVE-2024-45492)
Update Instructions
The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS expat 2.6.1-2ubuntu0.1 libexpat1 2.6.1-2ubuntu0.1 Ubuntu 20.04 LTS expat 2.2.9-1ubuntu0.7 libexpat1 2.2.9-1ubuntu0.7 Ubuntu 18.04 LTS expat 2.2.5-3ubuntu0.9+esm1 Available with Ubuntu Pro libexpat1 2.2.5-3ubuntu0.9+esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS expat 2.1.0-7ubuntu0.16.04.5+esm9 Available with Ubuntu Pro lib64expat1 2.1.0-7ubuntu0.16.04.5+esm9 Available with Ubuntu Pro libexpat1 2.1.0-7ubuntu0.16.04.5+esm9 Available with Ubuntu Pro Ubuntu 14.04 LTS expat 2.1.0-4ubuntu1.4+esm9 Available with Ubuntu Pro lib64expat1 2.1.0-4ubuntu1.4+esm9 Available with Ubuntu Pro libexpat1 2.1.0-4ubuntu1.4+esm9 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.
References
https://ubuntu.com/security/notices/USN-7000-1
CVE-2024-45490, CVE-2024-45491, CVE-2024-45492
Package Information
https://launchpad.net/ubuntu/+source/expat/2.6.1-2ubuntu0.1 https://launchpad.net/ubuntu/+source/expat/2.2.9-1ubuntu0.7
