CVE-2024-45491: Integer Overflow
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINTMAX equals SIZEMAX).
Other sources
libexpat could allow a local attacker to execute arbitrary code on the system, caused by an integer overflow in the dtdCopy function in xmlparse.c. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45491?
CVE-2024-45491 is classified as a high severity vulnerability due to the potential for integer overflow on 32-bit platforms.
How do I fix CVE-2024-45491?
To fix CVE-2024-45491, upgrade to libexpat version 2.6.3 or later.
Which versions of libexpat are affected by CVE-2024-45491?
Versions of libexpat earlier than 2.6.3 are affected by CVE-2024-45491.
Is CVE-2024-45491 specific to any operating system?
CVE-2024-45491 primarily affects 32-bit platforms.
What software can be impacted by CVE-2024-45491?
CVE-2024-45491 impacts libexpat, IBM Concert Software, and Debian packages that use affected versions.