CVE-2024-8176

EUVD-2024-54057
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
redhatCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 61%
Debian logo
Debian Releases
Debian Product
Codename
expat
bookworm
2.5.0-1+deb12u2
ignored
bookworm (security)
vulnerable
bullseye
ignored
bullseye (security)
vulnerable
forky
2.7.3-1
fixed
sid
2.7.3-1
fixed
trixie
2.7.1-2
fixed
libxmltok
bookworm
ignored
bullseye
ignored
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cadaver
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
xenial
needs-triage
apache2
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
trusty
not-affected
xenial
not-affected
apr-util
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
trusty
not-affected
xenial
not-affected
cmake
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
xenial
not-affected
ghostscript
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
xenial
not-affected
texlive-bin
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
xenial
not-affected
xmlrpc-c
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
trusty
needs-triage
xenial
needs-triage
vnc4
bionic
needs-triage
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
trusty
needs-triage
xenial
needs-triage
wbxml2
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
xenial
needs-triage
swish-e
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
xenial
needs-triage
insighttoolkit4
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
oracular
dne
plucky
dne
questing
dne
xenial
needs-triage
gdcm
bionic
needs-triage
focal
not-affected
jammy
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
trusty
not-affected
xenial
needs-triage
ayttm
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
xenial
needs-triage
cableswig
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
xenial
needs-triage
coin3
bionic
needs-triage
focal
not-affected
jammy
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
trusty
needs-triage
xenial
needs-triage
matanza
bionic
needs-triage
focal
needs-triage
jammy
ignored
noble
ignored
oracular
ignored
plucky
ignored
questing
ignored
xenial
needs-triage
tdom
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
xenial
needs-triage
vtk
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
trusty
needs-triage
xenial
needs-triage
smart
bionic
needs-triage
focal
dne
jammy
dne
noble
dne
oracular
dne
plucky
dne
questing
dne
xenial
needs-triage
firefox
focal
dne
jammy
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
thunderbird
focal
dne
jammy
not-affected
noble
not-affected
oracular
not-affected
plucky
not-affected
questing
not-affected
libxmltok
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
dne
xenial
needs-triage
expat
bionic
ignored
focal
ignored
jammy
Fixed 2.4.7-1ubuntu0.6
released
noble
Fixed 2.6.1-2ubuntu0.3
released
oracular
Fixed 2.6.2-2ubuntu0.2
released
plucky
Fixed 2.7.1-1
released
questing
Fixed 2.7.1-1
released
trusty
ignored
xenial
ignored
References