libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

An update of the expat package has been released.

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile     time.(CVE-2023-52426)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization expat security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - expat: Stack exhaustion in doctype parsing (CVE-2022-25313)

  - libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
    (CVE-2023-52426)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of expat installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-52426 advisory.

  - libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
    (CVE-2023-52426)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile     time.(CVE-2023-52426)

Tenable has extracted the preceding description block directly from the EulerOS expat security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
    (CVE-2023-52426)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b8656bc059 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
    (CVE-2023-52426)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-fbe1f0c1aa advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
    (CVE-2023-52426)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-524 advisory.

  - libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
    (CVE-2023-52426)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of expat installed on the remote host is prior to 2.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-038-01 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
    (CVE-2023-52426)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204549	Photon OS 4.0: Expat PHSA-2024-4.0-0581	Nessus	PhotonOS Local Security Checks	high
204460	Photon OS 5.0: Expat PHSA-2024-5.0-0216	Nessus	PhotonOS Local Security Checks	high
202680	EulerOS Virtualization 2.10.1 : expat (EulerOS-SA-2024-2000)	Nessus	Huawei Local Security Checks	medium
202675	EulerOS Virtualization 2.10.0 : expat (EulerOS-SA-2024-1982)	Nessus	Huawei Local Security Checks	medium
202310	RHEL 8 : expat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
201708	CBL Mariner 2.0 Security Update: expat (CVE-2023-52426)	Nessus	MarinerOS Local Security Checks	medium
201154	EulerOS 2.0 SP12 : expat (EulerOS-SA-2024-1868)	Nessus	Huawei Local Security Checks	medium
201132	EulerOS 2.0 SP12 : expat (EulerOS-SA-2024-1854)	Nessus	Huawei Local Security Checks	medium
198323	EulerOS 2.0 SP11 : expat (EulerOS-SA-2024-1786)	Nessus	Huawei Local Security Checks	medium
198317	EulerOS 2.0 SP11 : expat (EulerOS-SA-2024-1798)	Nessus	Huawei Local Security Checks	medium
198096	EulerOS Virtualization 2.11.0 : expat (EulerOS-SA-2024-1725)	Nessus	Huawei Local Security Checks	medium
198095	EulerOS Virtualization 2.11.1 : expat (EulerOS-SA-2024-1714)	Nessus	Huawei Local Security Checks	medium
195243	EulerOS 2.0 SP10 : expat (EulerOS-SA-2024-1564)	Nessus	Huawei Local Security Checks	medium
195238	EulerOS 2.0 SP10 : expat (EulerOS-SA-2024-1586)	Nessus	Huawei Local Security Checks	medium
190966	Fedora 38 : mingw-expat (2024-b8656bc059)	Nessus	Fedora Local Security Checks	high
190963	Fedora 39 : mingw-expat (2024-fbe1f0c1aa)	Nessus	Fedora Local Security Checks	high
190739	Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2024-524)	Nessus	Amazon Linux Local Security Checks	medium
190106	Slackware Linux 15.0 / current expat Multiple Vulnerabilities (SSA:2024-038-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2023-52426

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

medium

high