An update of the expat package has been released.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6754 advisory.

    * libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)

    * libexpat: Integer Overflow or Wraparound (CVE-2024-45491)

    * libexpat: integer overflow (CVE-2024-45492)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to AHV-10.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.0.1 advisory.

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and     1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files     outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.
    When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the     command-line interface), that means that an application which otherwise doesn't have access to the real     user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the     scenes, this directory is actually a bind mount and the data is stored in the per-application directory as     `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory     to still work as intended without general home directory access. However, the application does have write     access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source     directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the     application is started, the bind mount will follow the symlink and mount whatever it points to into the     sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the     patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by     two instances of a malicious app running in parallel. Closing the race condition requires updating or     patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the     patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with     `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar     option, then the version of bubblewrap that needs to be patched is a system copy that is distributed     separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux     distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with     `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is     included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`.
    This configuration is the default when building from source code. For the 1.14.x stable branch, these     changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has     been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10.
    The bundled version of bubblewrap in this release is a Meson wrap subproject, which has been updated to     0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS     distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or     update to newer versions if their stability policy allows it. As a workaround, avoid using applications     using the `persistent` (`--persist`) permission. (CVE-2024-42472)

  - The ipaddress module contained incorrect information about whether certain IPv4 and IPv6 addresses were     designated as globally reachable or private. This affected the is_private and is_global properties of     the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network     classes, where values wouldn't be returned in accordance with the latest information from the IANA     Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these     registries and thus have the intended behavior. (CVE-2024-4032)

  - There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive     backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar     archives. (CVE-2024-6232)

  - There is a MEDIUM severity vulnerability affecting CPython. The email module didn't properly quote     newlines for email headers when serializing an email message allowing for header injection when an email     is serialized. (CVE-2024-6923)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6989 advisory.

    * libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)
    * libexpat: Integer Overflow or Wraparound (CVE-2024-45491)
    * libexpat: integer overflow (CVE-2024-45492)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6989 advisory.

    * libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)

    * libexpat: Integer Overflow or Wraparound (CVE-2024-45491)

    * libexpat: integer overflow (CVE-2024-45492)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of expat / python3 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45492 advisory.

  - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0200 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-45490:
    An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for     XML_ParseBuffer.

    CVE-2024-45491:
    An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for     nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

    CVE-2024-45492:
    An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer     overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6754 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490)

    * libexpat: Integer Overflow or Wraparound (CVE-2024-45491)

    * libexpat: integer overflow (CVE-2024-45492)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 889eddee-a964-11ef-b680-4ccc6adda413 advisory.

    Qt qtwebengine-chromium repo reports:
    Backports for 16 security bugs in Chromium:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.8.3. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-15 and TNS-2024-16 advisories.

  - Nessus leverages third-party software to help provide underlying functionality. Several of the third-party     components (OpenSSL, expat) were found to contain vulnerabilities, and updated versions have been made     available by the providers.Out of caution and in line with best practice, Tenable has opted to upgrade     these components to address the potential impact of the issues. Nessus Version 10.8.3 updates OpenSSL to     version 3.0.15 and expat to version 2.6.3 to address the identified vulnerabilities. Tenable has released     Nessus 10.8.3 to address these issues. The installation files can be obtained from the Tenable Downloads     Portal: https://www.tenable.com/downloads/nessus (CVE-2024-45491, CVE-2024-45492, CVE-2024-6119)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 3092668e-97e4-11ef-bdd9-4ccc6adda413 advisory.

    Backports for 15 security bugs in Chromium:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory.

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core (LibExpat)). The     supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result     in takeover of Oracle HTTP Server. (CVE-2024-45492)

  - The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Oracle HTTP Server.  Successful attacks of this vulnerability     can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server     accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server     accessible data.(CVE-2023-38709)

  - The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged     attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.      Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access     to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts)(CVE-2023-49582)

  - The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Oracle HTTP Server.  Successful attacks of this vulnerability     can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server     accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server     accessible data (CVE-2024-38473)

  - The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTP to compromise Oracle HTTP Server.  Successful attacks of this vulnerability     can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server     accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server     accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). (CVE-2024-38475)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
207381	Photon OS 3.0: Expat PHSA-2024-3.0-0796	Nessus	PhotonOS Local Security Checks	2024/9/18	2025/3/21	critical
207939	Rocky Linux 9 : expat (RLSA-2024:6754)	Nessus	Rocky Linux Local Security Checks	2024/9/30	2025/3/21	critical
233215	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.0.1)	Nessus	Misc.	2025/3/22	2025/3/22	critical
207755	AlmaLinux 8 : expat (ALSA-2024:6989)	Nessus	Alma Linux Local Security Checks	2024/9/25	2024/9/25	critical
207948	Rocky Linux 8 : expat (RLSA-2024:6989)	Nessus	Rocky Linux Local Security Checks	2024/9/30	2025/3/21	critical
233160	Azure Linux 3.0 Security Update: expat / python3 (CVE-2024-45492)	Nessus	Azure Linux Local Security Checks	2025/3/20	2025/9/15	critical
236191	Alibaba Cloud Linux 3 : 0200: expat (ALINUX3-SA-2024:0200)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
207390	RHEL 9 : expat (RHSA-2024:6754)	Nessus	Red Hat Local Security Checks	2024/9/18	2025/4/2	critical
211775	FreeBSD : qt6-webengine -- Multiple vulnerabilities (889eddee-a964-11ef-b680-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	2024/11/24	2025/1/9	critical
207062	Tenable Nessus < 10.8.3 Multiple Vulnerabilities (TNS-2024-15 & TNS-2024-16)	Nessus	Misc.	2024/9/12	2024/9/12	critical
210058	FreeBSD : qt5-webengine -- Multiple vulnerabilities (3092668e-97e4-11ef-bdd9-4ccc6adda413)	Nessus	FreeBSD Local Security Checks	2024/11/1	2025/1/3	critical
214582	Oracle HTTP Server (January 2025 CPU)	Nessus	Web Servers	2025/1/24	2025/5/2	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical