Red Hat Product Security issued an advisory (RHSA-2024:6989) for libexpat in Red Hat Enterprise Linux 8 addressing three vulnerabilities: CVE-2024-45490 (negative length parsing vulnerability), CVE-2024-45491 (integer overflow or wraparound), and CVE-2024-45492 (integer overflow). These vulnerabilities relate to improper handling of input data lengths and integer calculations within the XML parsing library, potentially leading to memory corruption or other unintended behavior. The advisory provides updated libexpat packages for multiple architectures including x86_64, s390x, ppc64le, and aarch64. The security impact is rated moderate by Red Hat. Detailed CVSS scores and impact specifics are available on the respective CVE pages. No exploits in the wild have been reported. The advisory includes instructions and links for applying the update.

The vulnerabilities could allow an attacker to cause unexpected behavior in applications using the libexpat library by exploiting negative length parsing or integer overflow conditions. This may lead to memory corruption or denial of service. However, Red Hat rates the overall security impact as moderate, indicating that while the issues are significant, they are not considered critical or high severity. There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated libexpat packages for Red Hat Enterprise Linux 8 to address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2024:6989 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended and effective mitigation. No additional mitigation actions are indicated by the vendor.