Is CVE-2024-45490 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-45490 being exploited in the wild.

How severe is CVE-2024-45490?

High severity, with a CVSS score of 7.5, published 30 August 2024.

Which products and versions are affected?

libexpat Project libexpat versions before 2.6.3.

Is there a fix for CVE-2024-45490?

A patch was published on 2024-09-04: libexpat 2.6.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-45490 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-45490?

Check whether you run Libexpat Project Libexpat or libexpat Project libexpat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-45490: libexpat integer overflow in XML_ParseBuffer

CVE-2024-45490 · Severity: high · CVSS 7.5 · Published 2024-08-30

libexpat is a widely used open-source library for parsing XML data, integrated into many operating systems and applications. A vulnerability was found where the library fails to properly validate input lengths, which could allow a remote attacker to crash an application or potentially execute unauthorized code. This could lead to service disruptions or unauthorized access to sensitive systems that process XML files.

Technologies: Libexpat Project Libexpat. Vendors: Libexpat Project.

Quick answers

Is CVE-2024-45490 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-45490 being exploited in the wild.
How severe is CVE-2024-45490?: High severity, with a CVSS score of 7.5, published 30 August 2024.
Which products and versions are affected?: libexpat Project libexpat versions before 2.6.3.
Is there a fix for CVE-2024-45490?: A patch was published on 2024-09-04: libexpat 2.6.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-45490 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-45490?: Check whether you run Libexpat Project Libexpat or libexpat Project libexpat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in libexpat's xmlparse.c where the XML_ParseBuffer function does not validate that the 'len' parameter is non-negative. By providing a negative length, an attacker can trigger an integer overflow or improper memory handling. This can result in memory corruption, leading to a denial of service (application crash) or potentially remote code execution. The issue is reachable over the network if an application uses libexpat to parse untrusted XML input. The vulnerability is fixed in version 2.6.3.

Affected products

libexpat project libexpat versions before 2.6.3

Timeline

2024-08-26: disclosed: Issue reported on GitHub
2024-08-30: advisory: NVD publication date
2024-09-04: patched: libexpat 2.6.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.