Log in Start free

Vulnerability · Published Aug 30, 2024 · Assigned by mitre

CVE-2024-45491

High 7.3

In plain English

A high-severity integer overflow in the expat package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)1.1%top 33.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8expat2.2.5-15.el8_10ALSA-2024:6989
AlmaLinux:9expat2.5.0-2.el9_4.1ALSA-2024:6754
AlmaLinux:8expat-devel2.2.5-15.el8_10ALSA-2024:6989
AlmaLinux:9expat-devel2.5.0-2.el9_4.1ALSA-2024:6754
AlmaLinux:8xmlrpc-c1.51.0-10.el8_10ALSA-2024:8859
AlmaLinux:8xmlrpc-c-c++1.51.0-10.el8_10ALSA-2024:8859
AlmaLinux:8xmlrpc-c-client1.51.0-10.el8_10ALSA-2024:8859
AlmaLinux:8xmlrpc-c-client++1.51.0-10.el8_10ALSA-2024:8859
AlmaLinux:8xmlrpc-c-devel1.51.0-10.el8_10ALSA-2024:8859
Alpine:v3.20expat2.6.3-r0ALPINE-CVE-2024-45491
Alpine:v3.21expat2.6.3-r0ALPINE-CVE-2024-45491
Alpine:v3.22expat2.6.3-r0ALPINE-CVE-2024-45491
Alpine:v3.23expat2.6.3-r0ALPINE-CVE-2024-45491
Alpine:v3.24expat2.6.3-r0ALPINE-CVE-2024-45491
Alpine:v3.20qt5-qtwebengine5.15.16-r12ALPINE-CVE-2024-45491
Alpine:v3.21qt5-qtwebengine5.15.17-r3ALPINE-CVE-2024-45491
Alpine:v3.22qt5-qtwebengine5.15.17-r3ALPINE-CVE-2024-45491
Alpine:v3.23qt5-qtwebengine5.15.17-r3ALPINE-CVE-2024-45491
Alpine:v3.21qt6-qtwebengine6.7.2-r6ALPINE-CVE-2024-45491
Alpine:v3.22qt6-qtwebengine6.7.2-r6ALPINE-CVE-2024-45491
Alpine:v3.23qt6-qtwebengine6.7.2-r6ALPINE-CVE-2024-45491
Alpine:v3.24qt6-qtwebengine6.7.2-r6ALPINE-CVE-2024-45491
Debian:12expat2.5.0-1+deb12u1DEBIAN-CVE-2024-45491
Debian:12expat2.5.0-1+deb12u1DSA-5770-1
Debian:13expat2.6.2-2DEBIAN-CVE-2024-45491
Debian:14expat2.6.2-2DEBIAN-CVE-2024-45491
Debian:12libxmltokno fix listedDEBIAN-CVE-2024-45491
Rocky Linux:8expat0:2.2.5-15.el8_10RLSA-2024:6989
Rocky Linux:9expat0:2.5.0-2.el9_4.1RLSA-2024:6754
Rocky Linux:8xmlrpc-c0:1.51.0-10.el8_10RLSA-2024:8859
Ubuntu:22.04:LTScadaverno fix listedUBUNTU-CVE-2024-45491
Ubuntu:24.04:LTScadaverno fix listedUBUNTU-CVE-2024-45491
Ubuntu:25.10cadaverno fix listedUBUNTU-CVE-2024-45491
Ubuntu:26.04:LTScadaverno fix listedUBUNTU-CVE-2024-45491
Ubuntu:26.10cadaverno fix listedUBUNTU-CVE-2024-45491
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.4USN-7000-2
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.4UBUNTU-CVE-2024-45491
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.1USN-7000-1
Ubuntu:24.04:LTSexpat2.6.1-2ubuntu0.1UBUNTU-CVE-2024-45491
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2024-45491
Ubuntu:22.04:LTSmatanzano fix listedUBUNTU-CVE-2024-45491
Ubuntu:24.04:LTSmatanzano fix listedUBUNTU-CVE-2024-45491
Ubuntu:25.10matanzano fix listedUBUNTU-CVE-2024-45491
Ubuntu:26.04:LTSmatanzano fix listedUBUNTU-CVE-2024-45491
Ubuntu:26.10matanzano fix listedUBUNTU-CVE-2024-45491
Ubuntu:25.10swish-eno fix listedUBUNTU-CVE-2024-45491
Ubuntu:26.10swish-eno fix listedUBUNTU-CVE-2024-45491
Ubuntu:22.04:LTStdomno fix listedUBUNTU-CVE-2024-45491
Ubuntu:24.04:LTStdomno fix listedUBUNTU-CVE-2024-45491
Ubuntu:25.10tdomno fix listedUBUNTU-CVE-2024-45491
Ubuntu:26.04:LTStdomno fix listedUBUNTU-CVE-2024-45491
Ubuntu:26.10tdomno fix listedUBUNTU-CVE-2024-45491
Ubuntu:22.04:LTSwbxml2no fix listedUBUNTU-CVE-2024-45491
Ubuntu:24.04:LTSwbxml2no fix listedUBUNTU-CVE-2024-45491
Ubuntu:25.10wbxml2no fix listedUBUNTU-CVE-2024-45491
Ubuntu:26.04:LTSwbxml2no fix listedUBUNTU-CVE-2024-45491
Ubuntu:26.10wbxml2no fix listedUBUNTU-CVE-2024-45491
Ubuntu:25.10xmlrpc-cno fix listedUBUNTU-CVE-2024-45491
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2024-45491
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2024-45491

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References