Every CVE Search/ Get API key

CVE-2022-23990

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

7.5 HighPublic exploitFix available

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

4.69%Up 3.8 points since Feb 8, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Record
CVE-2022-23990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-190
Updated
2026-11-02
CVE List 7.5

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Record
CVE-2022-23990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2022-28905 7.5

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Record
EUVD-2022-28905
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-r3g2-gw56-v728 9.8

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Record
GHSA-r3g2-gw56-v728
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2022-23990 7.5

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Record
ALPINE-CVE-2022-23990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVAZL-8334 7.5

CVE-2022-23990 affecting package expat for versions less than 2.4.8-1

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Record
AZL-8334
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 29 moreShow less
OSVBELL-CVE-2022-23990 7.5

CVE-2022-23990 does not affect BellSoft software

Record
BELL-CVE-2022-23990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Record
CVE-2022-23990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2022-23990 7.5

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Record
DEBIAN-CVE-2022-23990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVJLSEC-2025-51 7.5

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Record
JLSEC-2025-51
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
OSVOESA-2022-1511 9.8

expat security update

An XML parser library.

Security Fix(es):

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.(CVE-2022-23852)

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.(CVE-2022-23990)

Record
OESA-2022-1511
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHBA-2022:4046 9.8

Red Hat Bug Fix Advisory: new packages: expat

Record
RHBA-2022:4046
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7811 9.8

Red Hat Security Advisory: mingw-expat security update

Record
RHSA-2022:7811
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:21776 7.5

Red Hat Security Advisory: expat security update

Record
RHSA-2025:21776
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:22607 7.5

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22607
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:22785 9.8

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22785
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22842 7.5

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22842
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:22871 9.8

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22871
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-23990 7.5

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Record
UBUNTU-CVE-2022-23990
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2022:7811 No score

Important: mingw-expat security update

Expat is a C library for parsing XML documents. The mingw-expat packages provide a port of the Expat library for MinGW.

The following packages have been upgraded to a later upstream version: mingw-expat (2.4.8). (BZ#2057023, BZ#2057037, BZ#2057127)

Security Fix(es):

  • expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)
  • expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)
  • expat: Integer overflow in storeRawNames() (CVE-2022-25315)
  • expat: Stack exhaustion in doctype parsing (CVE-2022-25313)
  • expat: Integer overflow in copyString() (CVE-2022-25314)
  • expat: Integer overflow in the doProlog function (CVE-2022-23990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:7811
Updated
2026-11-02
OSVALSA-2025:21776 No score

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:21776
Updated
2026-11-02
OSVASB-A-221256678 No score

In closeString of xmlparse.c, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Record
ASB-A-221256678
Updated
2026-11-05
OSVCLSA-2022-1660757175 No score

Fixed 15 CVEs in expat

  • CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
  • CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
  • CVE-2022-25315: Fix integer overflow in storeRawNames()
  • CVE-2022-22822: Fix integer overflow in addBinding()
  • CVE-2022-22823: Fix integer overflow in build_model()
  • CVE-2022-22824: Fix integer overflow in defineAttribute()
  • CVE-2022-22825: Fix integer overflow in lookup()
  • CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
  • CVE-2022-22827: Fix integer overflow in storeAtts()
  • CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
  • CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
  • CVE-2021-45960: Fix troublesome left shifts in storeAtts()
  • CVE-2022-23990: Fix integer overflow in doProlog()
  • CVE-2022-25313: Fix stack exhaustion in build_model()
  • CVE-2022-25314: Fix integer overflow in copyString()
Record
CLSA-2022-1660757175
Updated
2026-11-02
OSVCLSA-2022-1660758476 No score

Fixed 15 CVEs in expat

  • CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
  • CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
  • CVE-2022-25315: Fix integer overflow in storeRawNames()
  • CVE-2022-22822: Fix integer overflow in addBinding()
  • CVE-2022-22823: Fix integer overflow in build_model()
  • CVE-2022-22824: Fix integer overflow in defineAttribute()
  • CVE-2022-22825: Fix integer overflow in lookup()
  • CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
  • CVE-2022-22827: Fix integer overflow in storeAtts()
  • CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
  • CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
  • CVE-2021-45960: Fix troublesome left shifts in storeAtts()
  • CVE-2022-23990: Fix integer overflow in doProlog()
  • CVE-2022-25313: Fix stack exhaustion in build_model()
  • CVE-2022-25314: Fix integer overflow in copyString()
Record
CLSA-2022-1660758476
Updated
2026-11-02
OSVCLSA-2022-1660759632 No score

Fixed 13 CVEs in expat

  • CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
  • CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
  • CVE-2022-25315: Fix integer overflow in storeRawNames()
  • CVE-2022-22822: Fix integer overflow in addBinding()
  • CVE-2022-22823: Fix integer overflow in build_model()
  • CVE-2022-22824: Fix integer overflow in defineAttribute()
  • CVE-2022-22825: Fix integer overflow in lookup()
  • CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
  • CVE-2022-22827: Fix integer overflow in storeAtts()
  • CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
  • CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
  • CVE-2021-45960: Fix troublesome left shifts in storeAtts()
  • CVE-2022-23990: Fix integer overflow in doProlog()
Record
CLSA-2022-1660759632
Updated
2026-11-02
OSVCLSA-2022-1660760528 No score

Fix CVE(s): CVE-2022-25235, CVE-2022-23990, CVE-2022-22825, CVE-2022-22824, CVE-2022-23852, CVE-2022-25315, CVE-2022-25236, CVE-2021-46143, CVE-2022-25313, CVE-2021-45960, CVE-2022-22826, CVE-2022-22827, CVE-2022-22822, CVE-2022-22823

  • SECURITY UPDATE: Stack exhaustion
    • debian/patches/CVE-2022-25313.patch: prevent stack exhaustion in build_model in expat/lib/xmlparse.c.
    • debian/patches/fix-build_model-regression.patch: fix build_model regression in expat/lib/xmlparse.c.
    • CVE-2022-25313
  • SECURITY UPDATE: Integer overflow
    • debian/patches/CVE-2022-25315.patch: prevent integer overflow in storeRawNames in expat/lib/xmlparse.c.
    • CVE-2022-25315
  • SECURITY UPDATE: relax fix to CVE-2022-25236 with regard to RFC 3986 URI characters and possibly regressions
    • debian/patches/CVE-2022-25236-3.patch: add a note on namespace URI validation in expat/doc/reference.html, expat/lib/expat.h.
    • debian/patches/CVE-2022-25236-4.patch: document namespace separator effect right in header expat/lib/expat.h.
    • debian/patches/CVE-2022-25236-5.patch: cover relaxed fix in tests.
    • debian/patches/CVE-2022-25236-6.patch: relax fix with regard to RFC 3986 URI characters in expat/lib/xmlparse.c. (LP: #1963903)
  • fix tests adding XCS definition
    • debian/patches/fix_test_xcs.patch: in tests/runtests.c.
  • SECURITY UPDATE: Realloc misbehavior
    • debian/patches/CVE-2021-45960.patch: detect and prevent troublesome left shifts in function storeAtts in lib/xmlparse.c.
    • CVE-2021-45960
  • SECURITY UPDATE: Integer overflow
    • debian/patches/CVE-2021-46143.patch: prevent integer overflow on m_groupSize in function doProlog in lib/xmlparse.c.
    • CVE-2021-46143
  • SECURITY UPDATE: Integer overflow
    • debian/patches/CVE-2022-22822-to-CVE-2022-22827.patch: prevent integer overflow in multiple places in lib/xmlparse.c.
    • CVE-2022-22822
    • CVE-2022-22823
    • CVE-2022-22824
    • CVE-2022-22825
    • CVE-2022-22826
    • CVE-2022-22827
  • SECURITY UPDATE: Signed integer overflow
    • debian/patches/CVE-2022-23852-*.patch: detect and prevent integer overflow in XML_GetBuffer in expat/lib/xmlparse.c and adds test to cover it in tests/runtests.c.
    • CVE-2022-23852
  • SECURITY UPDATE: Integer overflow
    • debian/patches/CVE-2022-23990.patch: prevent integer overflow in doProlog in lib/xmlparse.c.
    • CVE-2022-23990
  • SECURITY UPDATE: Incomplete validation encoding
    • debian/patches/CVE-2022-25235-*.patch: adds missing validation and adds tests in expat/lib/xmltok_impl.c, expat/tests/runtests.c.
    • CVE-2022-25235
  • SECURITY UPDATE: Namespace-separator insertions
    • debian/patches/CVE-2022-25236-*.patch: Protect against malicious namespace declarations in expat/lib/xmlparse.c, expat/tests/runtests.c.
    • CVE-2022-25236
  • debian/patches/fixing_tests.patch: fixing tests in order to it work in xenial and oldest releases.
Record
CLSA-2022-1660760528
Updated
2026-11-02
OSVCLSA-2022-1660762248 No score

Fixed 13 CVEs in expat

  • CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
  • CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
  • CVE-2022-25315: Fix integer overflow in storeRawNames()
  • CVE-2022-22822: Fix integer overflow in addBinding()
  • CVE-2022-22823: Fix integer overflow in build_model()
  • CVE-2022-22824: Fix integer overflow in defineAttribute()
  • CVE-2022-22825: Fix integer overflow in lookup()
  • CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
  • CVE-2022-22827: Fix integer overflow in storeAtts()
  • CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
  • CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
  • CVE-2021-45960: Fix troublesome left shifts in storeAtts()
  • CVE-2022-23990: Fix integer overflow in doProlog()
Record
CLSA-2022-1660762248
Updated
2026-11-02
OSVCLSA-2023-1696877712 No score

expat: Fix of 2 CVEs

  • CVE-2022-23990: lib: prevent integer overflow in function doProlog
  • CVE-2022-43680: fix overeager DTD destruction in XML_ExternalEntityParserCreate
Record
CLSA-2023-1696877712
Updated
2026-11-02
OSVMGASA-2022-0048 No score

Updated expat packages fix security vulnerability

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. (CVE-2022-23852)

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. (CVE-2022-23990)

Record
MGASA-2022-0048
Updated
2026-11-02
OSVopenSUSE-SU-2022:0498-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054).
  • CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217).
Record
openSUSE-SU-2022:0498-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11793-1 No score

expat-2.4.4-1.1 on GA media

These are all security issues fixed in the expat-2.4.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11793-1
Updated
2026-11-02
OSVSUSE-SU-2022:0495-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054).
  • CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217).
Record
SUSE-SU-2022:0495-1
Updated
2026-11-02
OSVSUSE-SU-2022:0498-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054).
  • CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217).
Record
SUSE-SU-2022:0498-1
Updated
2026-11-02
OSVSUSE-SU-2022:14884-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054).
  • CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217).
Record
SUSE-SU-2022:14884-1
Updated
2026-11-02
OSVUSN-5288-1 No score

expat vulnerabilities

It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code.

Record
USN-5288-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
expat
Alpine:v3.12
 before 2.2.10-r1
2.2.10-r1
expat
Alpine:v3.13
 before 2.2.10-r3
2.2.10-r3
expat
Alpine:v3.14
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.15
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.16
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.17
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.18
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.19
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.20
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.21
 before 2.4.4-r0
2.4.4-r0
Show 160 moreShow less
Affected packages
PackageAffectedFixed
expat
Alpine:v3.22
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.23
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.24
 before 2.4.4-r0
2.4.4-r0
mingw32-expat
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.4.8-1.el8
2.4.8-1.el8
mingw64-expat
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.4.8-1.el8
2.4.8-1.el8
expat
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.5.0-1.el8_10
2.5.0-1.el8_10
expat-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.5.0-1.el8_10
2.5.0-1.el8_10
platform/external/expat
Android
 10:0 up to 10:2022-09-01, plus listed versions
10
10:2022-09-01
platform/external/expat
Android
 11:0 up to 11:2022-09-01, plus listed versions
11
11:2022-09-01
platform/external/expat
Android
 12:0 up to 12:2022-09-01, plus listed versions
12
12:2022-09-01
platform/external/expat
Android
 12L:0 up to 12L:2022-09-01, plus listed versions
12L
12L:2022-09-01
expat
Azure Linux:2
 before 2.4.8-1
2.4.8-1
expat
TuxCare:CentOS:8.4
From an advisory covering 15 CVEs
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat-devel
TuxCare:CentOS:8.4
From an advisory covering 15 CVEs
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat-static
TuxCare:CentOS:8.4
From an advisory covering 15 CVEs
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat
TuxCare:CentOS:8.5
From an advisory covering 15 CVEs
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat-devel
TuxCare:CentOS:8.5
From an advisory covering 15 CVEs
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat-static
TuxCare:CentOS:8.5
From an advisory covering 15 CVEs
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat
TuxCare:OracleLinux:6
From an advisory covering 13 CVEs
 before 2.0.1-13.el6_8.tuxcare.els1
2.0.1-13.el6_8.tuxcare.els1
expat-devel
TuxCare:OracleLinux:6
From an advisory covering 13 CVEs
 before 2.0.1-13.el6_8.tuxcare.els1
2.0.1-13.el6_8.tuxcare.els1
expat
TuxCare:Ubuntu:16.04
From an advisory covering 14 CVEs
 before 2.1.0-7ubuntu0.16.04.5+tuxcare.els1
2.1.0-7ubuntu0.16.04.5+tuxcare.els1
libexpat1
TuxCare:Ubuntu:16.04
From an advisory covering 14 CVEs
 before 2.1.0-7ubuntu0.16.04.5+tuxcare.els1
2.1.0-7ubuntu0.16.04.5+tuxcare.els1
libexpat1-dev
TuxCare:Ubuntu:16.04
From an advisory covering 14 CVEs
 before 2.1.0-7ubuntu0.16.04.5+tuxcare.els1
2.1.0-7ubuntu0.16.04.5+tuxcare.els1
expat
TuxCare:CentOS:6
From an advisory covering 13 CVEs
 before 2.0.1-13.el6_8.tuxcare.els1
2.0.1-13.el6_8.tuxcare.els1
expat-devel
TuxCare:CentOS:6
From an advisory covering 13 CVEs
 before 2.0.1-13.el6_8.tuxcare.els1
2.0.1-13.el6_8.tuxcare.els1
expat
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 2.1.0-15.el7_9.tuxcare.els1
2.1.0-15.el7_9.tuxcare.els1
expat-devel
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 2.1.0-15.el7_9.tuxcare.els1
2.1.0-15.el7_9.tuxcare.els1
expat-static
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 2.1.0-15.el7_9.tuxcare.els1
2.1.0-15.el7_9.tuxcare.els1
expat
Debian:12
 before 2.4.3-3
2.4.3-3
expat
Debian:13
 before 2.4.3-3
2.4.3-3
expat
Debian:14
 before 2.4.3-3
2.4.3-3
libxmltok
Debian:12
 All versions, plus listed versions
1.2-41.2-4.11.2-4.1~exp11.2-4.2
 None known
expat
Debian:9
From an advisory covering 10 CVEs
 before 2.2.0-2+deb9u4, plus listed versions
2.2.0-22.2.0-2+deb9u12.2.0-2+deb9u22.2.0-2+deb9u3
2.2.0-2+deb9u4
expat
Debian:10
From an advisory covering 10 CVEs
 before 2.2.6-2+deb10u2, plus listed versions
2.2.6-22.2.6-2+deb10u1
2.2.6-2+deb10u2
expat
Debian:11
From an advisory covering 10 CVEs
 before 2.2.10-2+deb11u1, plus listed versions
2.2.10-2
2.2.10-2+deb11u1
Expat_jll
Julia
 before 2.4.4+0
2.4.4+0
expat
Mageia:8
From an advisory covering 2 CVEs
 before 2.2.10-1.2.mga8
2.2.10-1.2.mga8
expat
openEuler:20.03-LTS-SP1
From an advisory covering 2 CVEs
 before 2.2.9-5.oe1
2.2.9-5.oe1
expat
openEuler:20.03-LTS-SP2
From an advisory covering 2 CVEs
 before 2.2.9-5.oe1
2.2.9-5.oe1
expat
openEuler:20.03-LTS-SP3
From an advisory covering 2 CVEs
 before 2.2.9-5.oe1
2.2.9-5.oe1
expat-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat
Red Hat:enterprise_linux:9::baseos
From an advisory covering 11 CVEs
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 11 CVEs
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 11 CVEs
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
mingw-expat
Red Hat:enterprise_linux:8::crb
From an advisory covering 6 CVEs
 before 0:2.4.8-1.el8
0:2.4.8-1.el8
mingw32-expat
Red Hat:enterprise_linux:8::crb
From an advisory covering 6 CVEs
 before 0:2.4.8-1.el8
0:2.4.8-1.el8
mingw32-expat-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 6 CVEs
 before 0:2.4.8-1.el8
0:2.4.8-1.el8
mingw64-expat
Red Hat:enterprise_linux:8::crb
From an advisory covering 6 CVEs
 before 0:2.4.8-1.el8
0:2.4.8-1.el8
mingw64-expat-debuginfo
Red Hat:enterprise_linux:8::crb
From an advisory covering 6 CVEs
 before 0:2.4.8-1.el8
0:2.4.8-1.el8
expat
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
expat-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
expat-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
expat-devel
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
expat
Red Hat:rhel_e4s:8.8::baseos
From an advisory covering 4 CVEs
 before 0:2.2.10-1.el8_8
0:2.2.10-1.el8_8
expat
Red Hat:rhel_tus:8.8::baseos
From an advisory covering 4 CVEs
 before 0:2.2.10-1.el8_8
0:2.2.10-1.el8_8
expat
Red Hat:rhel_aus:8.4::baseos
From an advisory covering 16 CVEs
 before 0:2.2.10-1.el8_4
0:2.2.10-1.el8_4
expat
Red Hat:rhel_eus_long_life:8.4::baseos
From an advisory covering 16 CVEs
 before 0:2.2.10-1.el8_4
0:2.2.10-1.el8_4
expat
Red Hat:rhel_aus:8.6::baseos
From an advisory covering 4 CVEs
 before 0:2.2.10-1.el8_6
0:2.2.10-1.el8_6
expat
Red Hat:rhel_e4s:8.6::baseos
From an advisory covering 4 CVEs
 before 0:2.2.10-1.el8_6
0:2.2.10-1.el8_6
expat
Red Hat:rhel_tus:8.6::baseos
From an advisory covering 4 CVEs
 before 0:2.2.10-1.el8_6
0:2.2.10-1.el8_6
expat
Red Hat:rhel_aus:8.2::baseos
From an advisory covering 18 CVEs
 before 0:2.2.10-1.el8_2
0:2.2.10-1.el8_2
expat
SUSE:HPE Helion OpenStack 8
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:OpenStack Cloud 8
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Real Time 15 SP2
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Manager Proxy 4.1
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Manager Server 4.1
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Micro 5.0
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Micro 5.1
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Enterprise Storage 6
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Enterprise Storage 7
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 2 CVEs
 before 2.0.1-88.42.15.1
2.0.1-88.42.15.1
expat
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 2 CVEs
 before 2.0.1-88.42.15.1
2.0.1-88.42.15.1
expat
Ubuntu:Pro:14.04:LTS
 before 2.1.0-4ubuntu1.4+esm4, plus listed versions
2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.12.1.0-4ubuntu1.22.1.0-4ubuntu1.32.1.0-4ubuntu1.42.1.0-4ubuntu1.4+esm12.1.0-4ubuntu1.4+esm2
2.1.0-4ubuntu1.4+esm4
coin3
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50-33.1.4~abc9f50-43.1.4~abc9f50-4ubuntu23.1.4~abc9f50-4ubuntu2+esm13.1.4~abc9f50-4ubuntu2+esm2
 None known
expat
Ubuntu:Pro:16.04:LTS
 before 2.1.0-7ubuntu0.16.04.5+esm2, plus listed versions
2.1.0-72.1.0-7ubuntu0.16.04.12.1.0-7ubuntu0.16.04.22.1.0-7ubuntu0.16.04.32.1.0-7ubuntu0.16.04.42.1.0-7ubuntu0.16.04.5
2.1.0-7ubuntu0.16.04.5+esm2
coin3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
 None known
matanza
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.13+ds1-5
 None known
tdom
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.8.3-1
 None known
wbxml2
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.10.7-1
 None known
expat
Ubuntu:18.04:LTS
 before 2.2.5-3ubuntu0.4, plus listed versions
2.2.3-12.2.3-22.2.5-0ubuntu22.2.5-32.2.5-3ubuntu0.12.2.5-3ubuntu0.2
2.2.5-3ubuntu0.4
coin3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-23.1.4~abc9f50+dfsg2-13.1.4~abc9f50+dfsg3-13.1.4~abc9f50+dfsg3-23.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
 None known
matanza
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.13+ds1-5build10.13+ds1-6
 None known
tdom
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.8.3-10.9.0-1
 None known
wbxml2
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.10.7-10.10.7-1build1
 None known
expat
Ubuntu:20.04:LTS
 before 2.2.9-1ubuntu0.2, plus listed versions
2.2.7-22.2.9-12.2.9-1build1
2.2.9-1ubuntu0.2
matanza
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.13+ds1-60.13+ds2-1
 None known
tdom
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.9.1-1
 None known
wbxml2
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.10.7-1build1
 None known
cadaver
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.23.3-2.1build1
 None known
firefox
Ubuntu:22.04:LTS
 before 1:1snap1-0ubuntu1, plus listed versions
93.0+build1-0ubuntu394.0+build3-0ubuntu194.0.2+build1-0ubuntu194.0.2+build2-0ubuntu195.0+build1-0ubuntu1
Show 9 moreShow less
95.0.1+build2-0ubuntu195.0.2+build1-0ubuntu196.0+build2-0ubuntu196.0.1+build1-0ubuntu196.0.2+build1-0ubuntu196.0.3+build1-0ubuntu197.0+build1-0ubuntu197.0+build2-0ubuntu197.0.1+build1-0ubuntu1
1:1snap1-0ubuntu1
matanza
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.13+ds2-1
 None known
tdom
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.9.2-1
 None known
thunderbird
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 34 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1
 None known
wbxml2
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.10.7-1build10.11.7+dfsg-1
 None known
swish-e
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.4.7-6build32.4.7-6.12.4.7-6.1build12.4.7-6.1ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.33.14-91.33.14-101.33.14-10ubuntu0.1~esm1
 None known
cadaver
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.24+dfsg-20.24+dfsg-30.24+dfsg-3build10.24+dfsg-3build2
 None known
matanza
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.13+ds2-10.13+ds2-1build10.13+ds2-1build2
 None known
tdom
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.9.3-10.9.3-1build1
 None known
thunderbird
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:115.3.1+build1-0ubuntu11:115.4.1+build1-0ubuntu11:115.4.3+build1-0ubuntu11:115.5.0+build1-0ubuntu11:115.5.1+build1-0ubuntu1
Show 9 moreShow less
1:115.5.2+build2-0ubuntu11:115.6.0+build1-0ubuntu11:115.6.0+build2-0ubuntu11:115.6.1+build1-0ubuntu11:115.8.0+build1-0ubuntu11:115.8.1+build1+snap21:115.8.1+build1+snap32:1snap1-0ubuntu12:1snap1-0ubuntu3
 None known
wbxml2
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.11.8+dfsg-30.11.8+dfsg-3build1
 None known
swish-e
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.4.7-6.22.4.7-6.2build12.4.7-6.2build22.4.7-6.2build32.4.7-6.2ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.33.14-111.33.14-11.11.33.14-121.33.14-12build11.33.14-12build21.33.14-12ubuntu0.1~esm1
 None known
cadaver
Ubuntu:25.10
 All versions, plus listed versions
0.26+dfsg-2
 None known
matanza
Ubuntu:25.10
 All versions, plus listed versions
0.13+ds2-2
 None known
swish-e
Ubuntu:25.10
 All versions, plus listed versions
2.4.7-6.32.4.7-6.3build12.4.7-7
 None known
tdom
Ubuntu:25.10
 All versions, plus listed versions
0.9.5.1-20.9.5.1-3
 None known
thunderbird
Ubuntu:25.10
 All versions, plus listed versions
2:1snap1-0ubuntu3
 None known
wbxml2
Ubuntu:25.10
 All versions, plus listed versions
0.11.10+dfsg-2
 None known
xmlrpc-c
Ubuntu:25.10
 All versions, plus listed versions
1.59.03-71.59.03-91.59.03-101.59.03-10.1
 None known
cadaver
Ubuntu:26.10
 All versions, plus listed versions
0.28+dfsg-2
 None known
matanza
Ubuntu:26.10
 All versions, plus listed versions
0.13+ds2-2build1
 None known
swish-e
Ubuntu:26.10
 All versions, plus listed versions
2.4.7-7.12.4.7-7.22.4.7-7.2build1
 None known
tdom
Ubuntu:26.10
 All versions, plus listed versions
0.9.6-20.9.6-3
 None known
thunderbird
Ubuntu:26.10
 All versions, plus listed versions
2:1snap1-0ubuntu5
 None known
wbxml2
Ubuntu:26.10
 All versions, plus listed versions
0.11.10+dfsg-30.11.10+dfsg-4
 None known
xmlrpc-c
Ubuntu:26.10
 All versions, plus listed versions
1.60.05-11.60.05-1build1
 None known
cadaver
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.26+dfsg-20.28+dfsg-10.28+dfsg-2
 None known
matanza
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.13+ds2-20.13+ds2-2build1
 None known
tdom
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.9.5.1-30.9.6-2
 None known
thunderbird
Ubuntu:26.04:LTS
 All versions, plus listed versions
2:1snap1-0ubuntu32:1snap1-0ubuntu42:1snap1-0ubuntu5
 None known
wbxml2
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.11.10+dfsg-20.11.10+dfsg-2build10.11.10+dfsg-3
 None known
xmlrpc-c
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.59.03-10.11.60.05-1
 None known
swish-e
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.4.7-72.4.7-7.12.4.7-7.1ubuntu0.1~esm1
 None known
expat
Ubuntu:Pro:14.04:LTS
From an advisory covering 12 CVEs
 before 2.1.0-4ubuntu1.4+esm4, plus listed versions
2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.12.1.0-4ubuntu1.22.1.0-4ubuntu1.32.1.0-4ubuntu1.42.1.0-4ubuntu1.4+esm12.1.0-4ubuntu1.4+esm2
2.1.0-4ubuntu1.4+esm4
expat
Ubuntu:Pro:16.04:LTS
From an advisory covering 12 CVEs
 before 2.1.0-7ubuntu0.16.04.5+esm2, plus listed versions
2.1.0-72.1.0-7ubuntu0.16.04.12.1.0-7ubuntu0.16.04.22.1.0-7ubuntu0.16.04.32.1.0-7ubuntu0.16.04.42.1.0-7ubuntu0.16.04.5
2.1.0-7ubuntu0.16.04.5+esm2
expat
Ubuntu:18.04:LTS
From an advisory covering 12 CVEs
 before 2.2.5-3ubuntu0.4, plus listed versions
2.2.3-12.2.3-22.2.5-0ubuntu22.2.5-32.2.5-3ubuntu0.12.2.5-3ubuntu0.2
2.2.5-3ubuntu0.4
expat
Ubuntu:20.04:LTS
From an advisory covering 12 CVEs
 before 2.2.9-1ubuntu0.2, plus listed versions
2.2.7-22.2.9-12.2.9-1build1
2.2.9-1ubuntu0.2
expat
openSUSE:Leap 15.3
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.4.4-1.1
2.4.4-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubSatheesh575555/external_expat_AOSP10_r33_CVE-2022-239902022-04-28

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-23990 is a high vulnerability (CVSS 7.5) in Libexpat Project Libexpat, published January 26, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.69%, the 91st percentile. Fixed in expat 2.2.10-r1.

References

Show 177 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open