Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 24.04 LTS USN-7001-2: High-Risk Libxmltok Vulnerabilities

ubuntu
Calendar Grey September 17, 2024
Scroller Ubuntu
Ubuntu Security Advisory USN-7001-2 provides critical updates for libxmltok to address significant vulnerabilities impacting Ubuntu 24.04 LTS.
Several security issues were fixed in libxmltok.

Summary

Several security issues were fixed in libxmltok.

Software Description:

- libxmltok: XML Parser Toolkit, developer libraries

Details:

USN-7001-1 fixed vulnerabilities in xmltol library. This update

provides the corresponding updates for Ubuntu 24.04 LTS.

Original advisory details:

 Shang-Hung Wan discovered that Expat, contained within the xmltok library,

 did not properly handle certain function calls when a negative input

 length was provided. An attacker could use this issue to cause a denial of

 service or possibly execute arbitrary code. (CVE-2024-45490)

 Shang-Hung Wan discovered that Expat, contained within the xmltok library,

 did not properly handle the potential for an integer overflow on 32-bit

 platforms. An attacker could use this issue to cause a denial of service

 or possibly execute arbitrary code. (CVE-2024-45491)

Topics%20covered

Topics Covered

security advisory denial of service software update arbitrary code execution Ubuntu vulnerability libxmltok

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   libxmltok1t64                   1.2-4.1ubuntu2.24.0.4.1+esm1
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-7001-2

  https://ubuntu.com/security/notices/USN-7001-1

  CVE-2024-45490, CVE-2024-45491

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-7001-2

Topics%20covered

Topics Covered

security advisory denial of service software update arbitrary code execution Ubuntu vulnerability libxmltok

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.