CVE-2023-52426
Fixed in a distro release EPSS <1%CVSS 5.5
libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
Products: Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SINEC NMS, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.16 | expat | 2.6.0-r0 |
| Alpine 3.17 | expat | 2.6.0-r0 |
| Alpine 3.18 | expat | 2.6.0-r0 |
| Alpine 3.19 | expat | 2.6.0-r0 |
| Alpine 3.20 | expat | 2.6.0-r0 |
| Alpine 3.21 | expat | 2.6.0-r0 |
| Alpine 3.22 | expat | 2.6.0-r0 |
| Alpine 3.23 | expat | 2.6.0-r0 |
| Alpine 3.24 | expat | 2.6.0-r0 |
| Amazon Linux 2023 | expat | 2.5.0-1.amzn2023.0.3 |
| Amazon Linux 2023 | expat-devel | 2.5.0-1.amzn2023.0.3 |
| Amazon Linux 2023 | expat-static | 2.5.0-1.amzn2023.0.3 |
| Amazon Linux 2023 | xmlrpc-c | 1.51.08-2.amzn2023.0.2 |
| Amazon Linux 2023 | xmlrpc-c-apps | 1.51.08-2.amzn2023.0.2 |
| Amazon Linux 2023 | xmlrpc-c-c++ | 1.51.08-2.amzn2023.0.2 |
| Amazon Linux 2023 | xmlrpc-c-client | 1.51.08-2.amzn2023.0.2 |
| Amazon Linux 2023 | xmlrpc-c-client++ | 1.51.08-2.amzn2023.0.2 |
| Amazon Linux 2023 | xmlrpc-c-devel | 1.51.08-2.amzn2023.0.2 |
| Debian 12 | expat | no fix |
| Debian 12 | libxmltok | no fix |
| Debian 13 | expat | 2.6.0-1 |
| Debian 14 | expat | 2.6.0-1 |
| SUSE Linux Micro 6.0 | expat | 2.7.1-1.1 |
| SUSE Linux Micro 6.1 | expat | 2.7.1-slfo.1.1_1.1 |
| Ubuntu 16.04 LTS | cadaver | no fix |
| Ubuntu 16.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 16.04 LTS | matanza | no fix |
| Ubuntu 16.04 LTS | tdom | no fix |
| Ubuntu 18.04 LTS | cadaver | no fix |
| Ubuntu 18.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 18.04 LTS | matanza | no fix |
| Ubuntu 18.04 LTS | tdom | no fix |
| Ubuntu 20.04 LTS | cadaver | no fix |
| Ubuntu 20.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 20.04 LTS | matanza | no fix |
| Ubuntu 20.04 LTS | tdom | no fix |
| Ubuntu 22.04 LTS | cadaver | no fix |
| Ubuntu 22.04 LTS | insighttoolkit4 | no fix |
| Ubuntu 22.04 LTS | matanza | no fix |
| Ubuntu 22.04 LTS | tdom | no fix |
| Ubuntu 24.04 LTS | cadaver | no fix |
| Ubuntu 24.04 LTS | expat | 2.6.0-1 |
| Ubuntu 24.04 LTS | matanza | no fix |
| Ubuntu 24.04 LTS | tdom | no fix |
| Ubuntu 24.04 LTS | wbxml2 | no fix |
| Ubuntu 25.10 | cadaver | no fix |
| Ubuntu 25.10 | matanza | no fix |
| Ubuntu 25.10 | swish-e | no fix |
| Ubuntu 25.10 | tdom | no fix |
| Ubuntu 25.10 | wbxml2 | no fix |
| Ubuntu 25.10 | xmlrpc-c | no fix |
| Ubuntu 26.04 LTS | cadaver | no fix |
| Ubuntu 26.04 LTS | matanza | no fix |
| Ubuntu 26.04 LTS | tdom | no fix |
| Ubuntu 26.04 LTS | wbxml2 | no fix |
| Ubuntu 26.04 LTS | xmlrpc-c | no fix |
| Ubuntu 26.10 | cadaver | no fix |
| Ubuntu 26.10 | matanza | no fix |
| Ubuntu 26.10 | swish-e | no fix |
| Ubuntu 26.10 | tdom | no fix |
| Ubuntu 26.10 | wbxml2 | no fix |
| Ubuntu 26.10 | xmlrpc-c | no fix |
| Ubuntu Pro 14.04 LTS | coin3 | no fix |
| Ubuntu Pro 14.04 LTS | vtk | no fix |
| Ubuntu Pro 16.04 LTS | ayttm | no fix |
| Ubuntu Pro 16.04 LTS | cableswig | no fix |
| Ubuntu Pro 16.04 LTS | coin3 | no fix |
| Ubuntu Pro 16.04 LTS | swish-e | no fix |
| Ubuntu Pro 16.04 LTS | vtk | no fix |
| Ubuntu Pro 18.04 LTS | coin3 | no fix |
| Ubuntu Pro 18.04 LTS | swish-e | no fix |
| Ubuntu Pro 20.04 LTS | swish-e | no fix |
| Ubuntu Pro 22.04 LTS | swish-e | no fix |
| Ubuntu Pro 24.04 LTS | swish-e | no fix |
| Ubuntu Pro 24.04 LTS | xmlrpc-c | no fix |
| Ubuntu Pro 26.04 LTS | swish-e | no fix |
| openSUSE Tumbleweed | expat | 2.6.0-1.1 |