Nixpkgs Security Tracker

Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2024-8176
7.5 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): NONE
  • Availability impact (A): HIGH
created 6 months, 1 week ago
Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.

References

Affected products

expat
  • *
rhcos
firefox
libexpat
  • <2.7.0
xmlrpc-c
  • *
lua-expat
mingw-expat
thunderbird
compat-expat1
firefox:flatpak/firefox
discovery/discovery-ui-rhel9
  • *
thunderbird:flatpak/thunderbird
discovery/discovery-server-rhel9
  • *
Red Hat JBoss Core Services 2.4.62.SP1
devworkspace/devworkspace-project-clone-rhel9
  • *
registry.redhat.io/discovery/discovery-ui-rhel9
  • *
registry.redhat.io/discovery/discovery-server-rhel9
  • *
registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9
  • *

Matching in nixpkgs

pkgs.expat

Stream-oriented XML parser library written in C

  • nixos-unstable -

pkgs.hexpatch

Binary patcher and editor written in Rust with a terminal user interface

  • nixos-unstable -

pkgs.xmlrpc_c

Lightweight RPC library based on XML and HTTP

pkgs.xulrunner

Web browser built from Firefox source tree

pkgs.firefoxpwa

Tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox (native component)

  • nixos-unstable -

pkgs.faust2firefox

The faust2firefox script, part of faust functional programming language for realtime audio signal processing

  • nixos-unstable -

pkgs.firefox_decrypt

Tool to extract passwords from profiles of Mozilla Firefox and derivates

  • nixos-unstable -

pkgs.firefox-sync-client

Commandline-utility to list/view/edit/delete entries in a firefox-sync account

  • nixos-unstable -

Package maintainers