7.5Yüksek

CVE-2024-8176Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

libexpat; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support Yayım: 2025-03-14 11:19 (1 yıl önce)

Açıklama

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.

Zayıflık türü (CWE): CWE-674

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
devworkspace	0.33	—
discovery	1.14	—
enterprise linux	8	—
enterprise linux	9	—
Red Hat	DevWorkspace Operator 0.33	all versions
Red Hat	Red Hat Discovery 1.14	all versions
Red Hat	Red Hat Enterprise Linux 10	all versions
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	all versions
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	all versions
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	all versions
Red Hat	Red Hat JBoss Core Services 2.4.62.SP1	—
Red Hat	Red Hat OpenShift Container Platform 4	all versions
rhel aus	8.2	—
rhel aus	8.4	—
rhel aus	8.6	—
rhel e4s	8.4	—
rhel e4s	8.6	—
rhel e4s	8.8	—
rhel e4s	9.0	—
rhel e4s	9.2	—
rhel eus	8.8	—
rhel eus	9.4	—
rhel eus long life	8.4	—
rhel tus	8.4	—
rhel tus	8.6	—
rhel tus	8.8	—
Siemens	RUGGEDCOM RST2428P	< V3.2
Siemens	SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family	< V3.2
Siemens	SCALANCE XCM-/XRM-/XCH-/XRH-300 family	< V3.2
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	V3.1.0 – < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	V3.1.0 – < V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	V3.1.0 – < V3.1.5
—	libexpat	< 2.7.0

Kaynaklar ve yamalar

RHSA-2025:13681 vendor-advisory
RHSA-2025:22033 vendor-advisory
RHSA-2025:22034 vendor-advisory
RHSA-2025:22035 vendor-advisory
RHSA-2025:22607 vendor-advisory
RHSA-2025:22785 vendor-advisory
RHSA-2025:22842 vendor-advisory
RHSA-2025:22871 vendor-advisory
RHSA-2025:3531 vendor-advisory
RHSA-2025:3734 vendor-advisory
RHSA-2025:3913 vendor-advisory
RHSA-2025:4048 vendor-advisory
RHSA-2025:4446 vendor-advisory
RHSA-2025:4447 vendor-advisory
RHSA-2025:4448 vendor-advisory
RHSA-2025:4449 vendor-advisory
RHSA-2025:7444 vendor-advisory
RHSA-2025:7512 vendor-advisory
RHSA-2025:8385 vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-8176 vdb-entry
RHBZ#2310137 issue-tracking
https://github.com/libexpat/libexpat/issues/893
https://github.com/libexpat/libexpat/pull/973
http://seclists.org/fulldisclosure/2025/May/10
http://seclists.org/fulldisclosure/2025/May/11
http://seclists.org/fulldisclosure/2025/May/12
http://seclists.org/fulldisclosure/2025/May/6
http://seclists.org/fulldisclosure/2025/May/7
http://seclists.org/fulldisclosure/2025/May/8
http://www.openwall.com/lists/oss-security/2025/03/15/1
http://www.openwall.com/lists/oss-security/2025/09/24/11
https://blog.hartwork.org/posts/expat-2-7-0-released/
https://bugzilla.suse.com/show_bug.cgi?id=1239618
https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes#L40-L52
https://gitlab.alpinelinux.org/alpine/aports/-/commit/d068c3ff36fc6f4789988a09c69b434db757db53
https://security-tracker.debian.org/tracker/CVE-2024-8176
https://security.netapp.com/advisory/ntap-20250328-0009/
https://ubuntu.com/security/CVE-2024-8176
https://www.kb.cert.org/vuls/id/760160
https://cert-portal.siemens.com/productcert/html/ssa-355557.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

CVSS puanı

7.5Yüksek

Kaynak: redhat · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yok
Bütünlük: Yok
Erişilebilirlik: Yüksek

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tüm puanlar (2)

cna	CVSS 3.1	7.5Yüksek
secalert@redhat.com	CVSS 3.1	7.5Yüksek

EPSS (30 günde istismar olasılığı)

1.35%

tüm CVE'lerin %72'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: poc
Otomatikleştirilebilir: yes
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2024-08-26
Yayımlandı2025-03-14 11:19
IP-DB'ye ulaştı2026-10-24 23:54
Son güncelleme2026-11-05 18:16

Numarayı veren (CNA): redhat
NVD durumu: Deferred

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Red Hat Enterprise Linux

3.9Düşük

CVE-2026-126644 5 saat önce

Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 9

A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component (os.chown with follow_symlinks=False and O_NOFOLLOW in _safe_open_write()). Whe…

7.3Yüksek

CVE-2026-91151 20 saat önce

Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Enterprise Linux 9.8 Extended Update Support

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it ca…

7.8Yüksek

CVE-2026-108472 21 saat önce

Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in…

7.5Yüksek

CVE-2026-91150 21 saat önce

Cockpit: cockpit: denial of service via unbounded fragmented websocket messages

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Enterprise Linux 9.8 Extended Update Support

A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a…

7.3Yüksek

CVE-2026-123747 21 saat önce

Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions

OpenPrinting pappl-retrofit; Red Hat Red Hat Enterprise Linux 10

A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal…

5.5Orta

CVE-2026-124746 dün

Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Hardened Images

A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attache…