Moderate: expat security update. {"type": "TYPE_SECURITY", "shortCode": "RL", "name": "RLSA-2024:6754", "synopsis": "Moderate: expat security update", "severity": "SEVERITY_MODERATE", "topic": "An update is available for expat.\nThis update affects Rocky Linux 9.\nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list", "description": "Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)\n\n* libexpat: Integer Overflow or Wraparound (CVE-2024-45491)\n\n* libexpat: integer overflow (CVE-2024-45492)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "solution": null, "affectedProducts": ["Rocky Linux 9"], "fixes": [{"ticket": "2308615", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2308615", "description": ""}, {"ticket": "2308616", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2308616", "description": ""}, {"ticket": "2308617", "sourceBy": "Red Hat", "sourceLink": "https://bugzilla.redhat.com/show_bug.cgi?id=2308617", "description": ""}], "cves": [{"name": "CVE-2024-45490", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2024-45490", "cvss3ScoringVector": "UNKNOWN", "cvss3BaseScore": "UNKNOWN", "cwe": "UNKNOWN"}, {"name": "CVE-2024-45491", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2024-45491", "cvss3ScoringVector": "UNKNOWN", "cvss3BaseScore": "UNKNOWN", "cwe": "UNKNOWN"}, {"name": "CVE-2024-45492", "sourceBy": "MITRE", "sourceLink": "https://www.cve.org/CVERecord?id=CVE-2024-45492", "cvss3ScoringVector": "UNKNOWN", "cvss3BaseScore": "UNKNOWN", "cwe": "UNKNOWN"}], "references": [], "publishedAt": "2024-09-30T14:31:38.136782Z", "rpms": {"Rocky Linux 9":{"nvras": ["expat-0:2.5.0-2.el9_4.1.aarch64.rpm", "expat-0:2.5.0-2.el9_4.1.i686.rpm", "expat-0:2.5.0-2.el9_4.1.ppc64le.rpm", "expat-0:2.5.0-2.el9_4.1.s390x.rpm", "expat-0:2.5.0-2.el9_4.1.src.rpm", "expat-0:2.5.0-2.el9_4.1.x86_64.rpm", "expat-debuginfo-0:2.5.0-2.el9_4.1.aarch64.rpm", "expat-debuginfo-0:2.5.0-2.el9_4.1.ppc64le.rpm", "expat-debuginfo-0:2.5.0-2.el9_4.1.s390x.rpm", "expat-debuginfo-0:2.5.0-2.el9_4.1.x86_64.rpm", "expat-debugsource-0:2.5.0-2.el9_4.1.aarch64.rpm", "expat-debugsource-0:2.5.0-2.el9_4.1.ppc64le.rpm", "expat-debugsource-0:2.5.0-2.el9_4.1.s390x.rpm", "expat-debugsource-0:2.5.0-2.el9_4.1.x86_64.rpm", "expat-devel-0:2.5.0-2.el9_4.1.aarch64.rpm", "expat-devel-0:2.5.0-2.el9_4.1.i686.rpm", "expat-devel-0:2.5.0-2.el9_4.1.ppc64le.rpm", "expat-devel-0:2.5.0-2.el9_4.1.s390x.rpm", "expat-devel-0:2.5.0-2.el9_4.1.x86_64.rpm"]}}, "rebootSuggested": false, "buildReferences": []}. Recent security patch for expat in Rocky Linux 9 resolves multiple significant vulnerabilities, strengthening overall system resilience.. Rocky Linux Expats. . LinuxSecurity.com Team
The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2024-6754 http://linux.oracle.com/errata/ELSA-2024-6754.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: expat-2.5.0-2.el9_4.1.i686.rpm expat-2.5.0-2.el9_4.1.x86_64.rpm expat-devel-2.5.0-2.el9_4.1.i686.rpm expat-devel-2.5.0-2.el9_4.1.x86_64.rpm aarch64: expat-2.5.0-2.el9_4.1.aarch64.rpm expat-devel-2.5.0-2.el9_4.1.aarch64.rpm SRPMS: http://oss.oracle.com/ol9/SRPMS-updates//expat-2.5.0-2.el9_4.1.src.rpm Related CVEs: CVE-2024-45490 CVE-2024-45491 CVE-2024-45492 Description of changes: [2.5.0-2.1] - Fix multiple CVEs - Fix CVE-2024-45492 integer overflow - Fix CVE-2024-45491 Integer Overflow or Wraparound - Fix CVE-2024-45490 Negative Length Parsing Vulnerability - Resolves: RHEL-57510 - Resolves: RHEL-57497 - Resolves: RHEL-56763 _______________________________________________ El-errata mailing list
Update to expat-2.6.3.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-c7b547bec5 2024-09-14 01:57:36.689518 -------------------------------------------------------------------------------- Name : mingw-expat Product : Fedora 40 Version : 2.6.3 Release : 1.fc40 URL : http://www.libexpat.org/ Summary : MinGW Windows port of expat XML parser library Description : This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parsed. A start tag is an example of the kind of structures for which you may register handlers. -------------------------------------------------------------------------------- Update Information: Update to expat-2.6.3. -------------------------------------------------------------------------------- ChangeLog: * Thu Sep 5 2024 Sandro Mani - 2.6.3-1 - Update to 2.6.3 * Thu Jul 18 2024 Fedora Release Engineering - 2.6.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild * Fri Mar 22 2024 Sandro Mani - 2.6.2-1 - Update to 2.6.2 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2308682 - CVE-2024-45490 mingw-expat: Negative Length Parsing Vulnerability in libexpat [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2308682 [ 2 ] Bug #2308684 - CVE-2024-45490 mingw-expat: Negative Length Parsing Vulnerability in libexpat [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2308684 [ 3 ] Bug #2310142 - CVE-2024-45491 mingw-expat: Integer Overflow or Wraparound [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2310142 [ 4 ] Bug #2310145 - CVE-2024-45491 mingw-expat: Integer Overflow or Wraparound[fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2310145 [ 5 ] Bug #2310148 - CVE-2024-45492 mingw-expat: integer overflow [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2310148 [ 6 ] Bug #2310151 - CVE-2024-45492 mingw-expat: integer overflow [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2310151 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-c7b547bec5' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Update to expat-2.6.3.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-e86a48cd72 2024-09-14 01:25:52.789546 -------------------------------------------------------------------------------- Name : mingw-expat Product : Fedora 39 Version : 2.6.3 Release : 1.fc39 URL : http://www.libexpat.org/ Summary : MinGW Windows port of expat XML parser library Description : This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parsed. A start tag is an example of the kind of structures for which you may register handlers. -------------------------------------------------------------------------------- Update Information: Update to expat-2.6.3. -------------------------------------------------------------------------------- ChangeLog: * Thu Sep 5 2024 Sandro Mani - 2.6.3-1 - Update to 2.6.3 * Thu Jul 18 2024 Fedora Release Engineering - 2.6.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild * Fri Mar 22 2024 Sandro Mani - 2.6.2-1 - Update to 2.6.2 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2308682 - CVE-2024-45490 mingw-expat: Negative Length Parsing Vulnerability in libexpat [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2308682 [ 2 ] Bug #2308684 - CVE-2024-45490 mingw-expat: Negative Length Parsing Vulnerability in libexpat [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2308684 [ 3 ] Bug #2310142 - CVE-2024-45491 mingw-expat: Integer Overflow or Wraparound [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2310142 [ 4 ] Bug #2310145 - CVE-2024-45491 mingw-expat: Integer Overflow or Wraparound[fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2310145 [ 5 ] Bug #2310148 - CVE-2024-45492 mingw-expat: integer overflow [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2310148 [ 6 ] Bug #2310151 - CVE-2024-45492 mingw-expat: integer overflow [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2310151 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-e86a48cd72' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Update to expat-2.6.3.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-c5d55d5845 2024-09-13 20:43:08.472730 -------------------------------------------------------------------------------- Name : mingw-expat Product : Fedora 41 Version : 2.6.3 Release : 1.fc41 URL : http://www.libexpat.org/ Summary : MinGW Windows port of expat XML parser library Description : This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parsed. A start tag is an example of the kind of structures for which you may register handlers. -------------------------------------------------------------------------------- Update Information: Update to expat-2.6.3. -------------------------------------------------------------------------------- ChangeLog: * Thu Sep 5 2024 Sandro Mani - 2.6.3-1 - Update to 2.6.3 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2308682 - CVE-2024-45490 mingw-expat: Negative Length Parsing Vulnerability in libexpat [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2308682 [ 2 ] Bug #2308684 - CVE-2024-45490 mingw-expat: Negative Length Parsing Vulnerability in libexpat [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2308684 [ 3 ] Bug #2310142 - CVE-2024-45491 mingw-expat: Integer Overflow or Wraparound [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2310142 [ 4 ] Bug #2310145 - CVE-2024-45491 mingw-expat: Integer Overflow or Wraparound [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2310145 [ 5 ] Bug #2310148 - CVE-2024-45492 mingw-expat: integer overflow [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2310148 [ 6 ] Bug #2310151 - CVE-2024-45492 mingw-expat: integer overflow [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2310151 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-c5d55d5845' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.