libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

The remote SUSE Linux SLED12 / SLED_SAP12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1667-1 advisory.

  - A use-after-free exists in Python through 3.9 via heappushpop in heapq. (CVE-2022-48560)

  - The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special     character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some     applications, an attacker can bypass a protection mechanism in which application access is granted only     after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be     used for signup). This occurs in email/_parseaddr.py in recent versions of Python. (CVE-2023-27043)

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1657-1 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000139630 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2839 advisory.

  - expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - expat: Undefined behavior and pointer overflows (CVE-2016-4472)

  - The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-     dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML     document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876. (CVE-2016-5300)

  - XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows     attackers to put the parser in an infinite loop using a malformed external entity definition from an     external DTD. (CVE-2017-9233)

  - Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. (CVE-2022-23990)

  - In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large     nesting depth in the DTD element. (CVE-2022-25313)

  - In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. (CVE-2022-25314)

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
    (CVE-2023-52426)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)

  - expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852)

  - The overflow protection in Expat is removed by compilers with certain optimization settings, which allows     remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML     data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
    (CVE-2016-4472)

  - The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-     dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML     document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876. (CVE-2016-5300)

  - XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows     attackers to put the parser in an infinite loop using a malformed external entity definition from an     external DTD. (CVE-2017-9233)

  - In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons     could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be     usable for denial-of-service attacks). (CVE-2018-20843)

  - In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to     document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber)     then resulted in a heap-based buffer over-read. (CVE-2019-15903)

  - In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for     m_groupSize. (CVE-2021-46143)

  - addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22822)

  - build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22823)

  - defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22824)

  - lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22825)

  - nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
    (CVE-2022-22826)

  - storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22827)

  - Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. (CVE-2022-23990)

  - In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large     nesting depth in the DTD element. (CVE-2022-25313)

  - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
    (CVE-2023-52426)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1556-1 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7,     3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks     during cleanup of permissions-related errors. This means users which can run privileged programs are     potentially able to modify permissions of files referenced by symlinks in some circumstances.
    (CVE-2023-6597)

  - An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and     3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the zip     format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile     module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2575 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3783 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1129-1 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external     parsers (created via XML_ExternalEntityParserCreate). (CVE-2024-28757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1162-1 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7,     3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks     during cleanup of permissions-related errors. This means users which can run privileged programs are     potentially able to modify permissions of files referenced by symlinks in some circumstances.
    (CVE-2023-6597)

  - An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and     3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the zip     format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile     module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:1615 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-1615 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:1615 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:1615 advisory.

  - expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2024:1615 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1009-1 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.2, 3.11.8,     3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks     during cleanup of permissions-related errors. This means users which can run privileged programs are     potentially able to modify permissions of files referenced by symlinks in some circumstances.
    (CVE-2023-6597)

  - An issue was found in the CPython `zipfile` module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and     3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the zip     format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile     module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1530 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external     parsers (created via XML_ExternalEntityParserCreate). (CVE-2024-28757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1530 advisory.

  - expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

  - expat: XML Entity Expansion (CVE-2024-28757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python3 installed on the remote host is prior to 3.9.19. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-080-01 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.2, 3.11.8,     3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks     during cleanup of permissions-related errors. This means users which can run privileged programs are     potentially able to modify permissions of files referenced by symlinks in some circumstances.
    (CVE-2023-6597)

  - An issue was found in the CPython `zipfile` module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and     3.8.18 and prior. The zipfile module is vulnerable to quoted-overlap zip-bombs which exploit the zip     format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile     module reject zip archives which overlap entries in the archive. (CVE-2024-0450)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6694-1 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external     parsers (created via XML_ExternalEntityParserCreate). (CVE-2024-28757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM HTTP Server running on the remote host is affected by a denaial of service vulnerability.

 - libexpat is vulnerable to a denial of service, caused by improper system    resource allocation. By sending a specially crafted request using an overly    large token, a remote attacker could exploit this vulnerability to cause a    denial of service. (CVE-2023-5245)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b8656bc059 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
    (CVE-2023-52426)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-fbe1f0c1aa advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
    (CVE-2023-52426)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of expat installed on the remote host is prior to 2.6.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-038-01 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
    (CVE-2023-52426)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
197289	SUSE SLED12 / SLES12 Security Update : python (SUSE-SU-2024:1667-1)	Nessus	SuSE Local Security Checks	medium
197171	SUSE SLES12 Security Update : python3 (SUSE-SU-2024:1657-1)	Nessus	SuSE Local Security Checks	high
197154	F5 Networks BIG-IP : Expat vulnerability (K000139630)	Nessus	F5 Networks Local Security Checks	high
197022	RHEL 8 : expat (RHSA-2024:2839)	Nessus	Red Hat Local Security Checks	high
195657	RHEL 7 : expat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195622	RHEL 6 : expat (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195191	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python311 (SUSE-SU-2024:1556-1)	Nessus	SuSE Local Security Checks	high
194833	RHEL 8 : expat (RHSA-2024:2575)	Nessus	Red Hat Local Security Checks	high
193076	Debian dla-3783 : expat - security update	Nessus	Debian Local Security Checks	high
193073	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : expat (SUSE-SU-2024:1129-1)	Nessus	SuSE Local Security Checks	high
193049	SUSE SLES15 / openSUSE 15 Security Update : python310 (SUSE-SU-2024:1162-1)	Nessus	SuSE Local Security Checks	high
192955	Rocky Linux 8 : expat (RLSA-2024:1615)	Nessus	Rocky Linux Local Security Checks	high
192909	Oracle Linux 8 : expat (ELSA-2024-1615)	Nessus	Oracle Linux Local Security Checks	high
192895	AlmaLinux 8 : expat (ALSA-2024:1615)	Nessus	Alma Linux Local Security Checks	high
192871	RHEL 8 : expat (RHSA-2024:1615)	Nessus	Red Hat Local Security Checks	high
192857	CentOS 8 : expat (CESA-2024:1615)	Nessus	CentOS Local Security Checks	high
192649	SUSE SLES15 / openSUSE 15 Security Update : python39 (SUSE-SU-2024:1009-1)	Nessus	SuSE Local Security Checks	high
192599	Oracle Linux 9 : expat (ELSA-2024-1530)	Nessus	Oracle Linux Local Security Checks	high
192582	RHEL 9 : expat (RHSA-2024:1530)	Nessus	Red Hat Local Security Checks	high
192321	Slackware Linux 15.0 / current python3 Multiple Vulnerabilities (SSA:2024-080-01)	Nessus	Slackware Local Security Checks	high
192118	Ubuntu 22.04 LTS / 23.10 : Expat vulnerabilities (USN-6694-1)	Nessus	Ubuntu Local Security Checks	high
191707	IBM HTTP Server 8.5.0.0 < 8.5.5.26 / 9.0.0.0 < 9.0.5.18 DoS (7129933)	Nessus	Web Servers	high
190966	Fedora 38 : mingw-expat (2024-b8656bc059)	Nessus	Fedora Local Security Checks	high
190963	Fedora 39 : mingw-expat (2024-fbe1f0c1aa)	Nessus	Fedora Local Security Checks	high
190106	Slackware Linux 15.0 / current expat Multiple Vulnerabilities (SSA:2024-038-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2023-52425

high

Tenable Plugins

medium

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high