CVE-2021-45960
expat - security update
8.8
HIGH
CVSS 3.1
EPSS 0.31%
Description
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
How to fix CVE-2021-45960
To remediate CVE-2021-45960, upgrade the affected package to a fixed version below.
- Alpine/expat—upgrade to 2.2.10-r0 or later
- —upgrade to 2.2.10-2+deb11u1 or later
- —upgrade to 2.2.0-2+deb9u4 or later
- —upgrade to 2.2.6-2+deb10u2 or later
- —no fix listed
Is CVE-2021-45960 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.
Affected packages (5)
- from 0, < 2.2.10-r0
- from 0, < 2.2.10-2+deb11u1
- from 0, < 2.2.0-2+deb9u4
- from 0, < 2.2.6-2+deb10u2
- from 0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |