Updated mozjs78 packages fix security vulnerabilities
Publication date: 27 Oct 2024Modification date: 27 Oct 2024
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-45490 , CVE-2024-45491 , CVE-2024-45492
Description
An issue was discovered in libexpat before 2.6.3. xmlparse.c does not
reject a negative length for XML_ParseBuffer. (CVE-2024-45490)
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c
can have an integer overflow for nDefaultAtts on 32-bit platforms (where
UINT_MAX equals SIZE_MAX). (CVE-2024-45491)
An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in
xmlparse.c can have an integer overflow for m_groupSize on 32-bit
platforms (where UINT_MAX equals SIZE_MAX). (CVE-2024-45492)
References
- https://bugs.mageia.org/show_bug.cgi?id=33630
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/NII5WWMANSN5NYNMNOK7LJ2P5FT7TW5X/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45490
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45491
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45492
SRPMS
9/core
- mozjs78-78.15.0-7.1.mga9