USN-8790-1: Expat vulnerabilities
What it means
Ubuntu ha rilasciato un aggiornamento di sicurezza (USN-8790-1) che include diversi problemi di sicurezza in Expat, una libreria per la parsing XML. Le vulnerabilità possono portare a denial of service (DoS) grazie a errori di gestione della memoria, loop infiniti e uso improprio di risorse. Le patch sono disponibili per Ubuntu 14.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS e 26.04 LTS. L'aggiornamento è necessario per mitigare i rischi associati a queste vulnerabilità.
Why it matters
Le vulnerabilità in Expat possono essere sfruttate per causare un denial of service, compromettendo la disponibilità di servizi critici per le PMI italiane. L'aggiornamento è essenziale per ridurre la superficie esposta e prevenire attacchi mirati a sistemi basati su Ubuntu.
Recommended actions
- Applicare le patch disponibili per Ubuntu 14.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS e 26.04 LTS
- Verificare la versione di libexpat1 e altri pacchetti correlati per garantire l'aggiornamento
- Configurare firewall e regole di accesso per limitare l'accesso a file XML sensibili
- Monitorare i log di sistema per rilevare picchi di utilizzo delle risorse o crash imprevisti
- Utilizzare Ubuntu Pro per ottenere supporto di sicurezza aggiuntivo e aggiornamenti tempestivi
- Eseguire test di vulnerabilità su applicazioni che utilizzano Expat per verificare la correttezza delle patch
Potential operational benefits
- Riduzione della superficie esposta a vulnerabilità in Expat
- Miglioramento della disponibilità dei servizi critici
- Riduzione del rischio di attacchi di tipo denial of service
- Supporto di sicurezza aggiuntivo grazie a Ubuntu Pro
Translation in progress
The official content is available in the original language. The Italian version will be published once automated checks are complete.
Text acquired from the source
It was discovered that Expat could be made to allocate large amounts of memory when parsing a small crafted document. An attacker could possibly use this issue to cause Expat to consume resources, leading to a denial of service. This issue was only addressed in Ubuntu 24.04 LTS. (CVE-2025-59375) It was discovered that Expat incorrectly handled empty external parameter entity content. An attacker could possibly use this issue to cause Expat to crash, resulting in a denial of service. (CVE-2026-32776) It was discovered that Expat incorrectly handled certain DTD content. An attacker could possibly use this issue to cause Expat to enter an infinite loop, resulting in a denial of service. (CVE-2026-32777) It was discovered that Expat incorrectly handled memory when retrying after an earlier out-of-memory condition. An attacker could possibly use this issue to cause Expat to crash, resulting in a denial of service. (CVE-2026-32778) It was discovered that Expat performed attribute name collision checks inefficiently. An attacker could possibly use this issue to cause Expat to consume resources when processing a moderately sized crafted XML document, resulting in a denial of service. This issue was only addressed in Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-45186) It was discovered that Expat used insufficient entropy, allowing hash flooding through a crafted XML document. An attacker could possibly use this issue to cause Expat to consume resources, leading to a denial of service. This issue was only addressed in Ubuntu 14.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-41080) It was discovered that Expat did not track handler call depth for certain functions called from within handlers, leading to a use-after-free. An attacker could possibly use this issue to
- Source
- Ubuntu Security Notices
- Publishing entity
- Ubuntu Security
- Entity type
- vendor security
- Area
- Global
- Original language
- en · translation in preparation
- Publication
- 21/09/2026 15:50
- MITRE ATT&CK
- T1562, T1562.001, T1486
- CVE
- CVE-2025-59375, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-45186, CVE-2026-41080
Affected products and versions
The collector will check NVD and the available official vendor advisories.