libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000139637 advisory.

  - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external     parsers (created via XML_ExternalEntityParserCreate). (CVE-2024-28757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-afb73e6f62 advisory.

  - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external     parsers (created via XML_ExternalEntityParserCreate). (CVE-2024-28757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1129-1 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external     parsers (created via XML_ExternalEntityParserCreate). (CVE-2024-28757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-576 advisory.

  - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external     parsers (created via XML_ExternalEntityParserCreate). (CVE-2024-28757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1530 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external     parsers (created via XML_ExternalEntityParserCreate). (CVE-2024-28757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1530 advisory.

  - expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

  - expat: XML Entity Expansion (CVE-2024-28757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-4e6e660fae advisory.

  - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external     parsers (created via XML_ExternalEntityParserCreate). (CVE-2024-28757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-40b98c9ced advisory.

  - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external     parsers (created via XML_ExternalEntityParserCreate). (CVE-2024-28757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6694-1 advisory.

  - libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are     required in the case of a large token for which multiple buffer fills are needed. (CVE-2023-52425)

  - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external     parsers (created via XML_ExternalEntityParserCreate). (CVE-2024-28757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of expat installed on the remote host is prior to 2.6.2. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-073-01 advisory.

  - libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external     parsers (created via XML_ExternalEntityParserCreate). (CVE-2024-28757)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
197155	F5 Networks BIG-IP : Expat vulnerability (K000139637)	Nessus	F5 Networks Local Security Checks	high
194557	Fedora 40 : mingw-expat (2024-afb73e6f62)	Nessus	Fedora Local Security Checks	high
193073	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : expat (SUSE-SU-2024:1129-1)	Nessus	SuSE Local Security Checks	high
192890	Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2024-576)	Nessus	Amazon Linux Local Security Checks	high
192599	Oracle Linux 9 : expat (ELSA-2024-1530)	Nessus	Oracle Linux Local Security Checks	high
192582	RHEL 9 : expat (RHSA-2024:1530)	Nessus	Red Hat Local Security Checks	high
192226	Fedora 39 : mingw-expat (2024-4e6e660fae)	Nessus	Fedora Local Security Checks	high
192224	Fedora 38 : mingw-expat (2024-40b98c9ced)	Nessus	Fedora Local Security Checks	high
192118	Ubuntu 22.04 LTS / 23.10 : Expat vulnerabilities (USN-6694-1)	Nessus	Ubuntu Local Security Checks	high
192047	Slackware Linux 15.0 / current expat Vulnerability (SSA:2024-073-01)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2024-28757

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

critical