USN-7424-1: Expat vulnerability

USN-7424-1: Expat vulnerability
8 April 2025

Expat could be made to crash if it received specially crafted input.

Releases

• Ubuntu 24.10
• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS

Packages

• expat - XML parsing C library

Details
It was discovered that Expat could crash due to stack overflow when
processing XML documents with deeply nested entity references. If a user
or automated system were tricked into processing specially crafted XML
input, an attacker could use this issue to cause a denial of service.

Update instructions
The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.10

• expat - 2.6.2-2ubuntu0.2
• libexpat1 - 2.6.2-2ubuntu0.2

Ubuntu 24.04

• expat - 2.6.1-2ubuntu0.3
• libexpat1 - 2.6.1-2ubuntu0.3

Ubuntu 22.04

• expat - 2.4.7-1ubuntu0.6
• libexpat1 - 2.4.7-1ubuntu0.6
  In general, a standard system update will make all the necessary changes.