Every CVE Search/ Get API key

CVE-2022-23852

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for...

9.8 CriticalPublic exploitFix available

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

5.08%Up 4.2 points since Feb 8, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Record
CVE-2022-23852
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-190
Updated
2026-11-02
CVE List 9.8

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Record
CVE-2022-23852
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2022-28778 9.8

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Record
EUVD-2022-28778
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-h83g-c7g2-6r9h 9.8

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for...

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Record
GHSA-h83g-c7g2-6r9h
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2022-23852 9.8

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Record
ALPINE-CVE-2022-23852
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVAZL-7835 9.8

CVE-2022-23852 affecting package expat for versions less than 2.4.8-1

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Record
AZL-7835
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 26 moreShow less
OSVBELL-CVE-2022-23852 9.8

CVE-2022-23852 does not affect BellSoft software

Record
BELL-CVE-2022-23852
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Record
CVE-2022-23852
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2022-23852 9.8

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Record
DEBIAN-CVE-2022-23852
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVJLSEC-2025-50 9.8

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in `XML_GetBuffer`, for...

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Record
JLSEC-2025-50
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
OSVOESA-2022-1511 9.8

expat security update

An XML parser library.

Security Fix(es):

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.(CVE-2022-23852)

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.(CVE-2022-23990)

Record
OESA-2022-1511
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHBA-2022:4046 9.8

Red Hat Bug Fix Advisory: new packages: expat

Record
RHBA-2022:4046
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0951 9.8

Red Hat Security Advisory: expat security update

Record
RHSA-2022:0951
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:1069 9.8

Red Hat Security Advisory: expat security update

Record
RHSA-2022:1069
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:4834 9.8

Red Hat Security Advisory: expat security update

Record
RHSA-2022:4834
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:0951 9.8

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

  • expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)

  • expat: Integer overflow in storeRawNames() (CVE-2022-25315)

  • expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)

  • expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)

  • expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)

  • expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)

  • expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)

  • expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)

  • expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)

  • expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)

  • expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2022:0951
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-23852 9.8

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Record
UBUNTU-CVE-2022-23852
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2022:0951 No score

Important: expat security update

Expat is a C library for parsing XML documents. Security Fix(es):

  • expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)
  • expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)
  • expat: Integer overflow in storeRawNames() (CVE-2022-25315)
  • expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)
  • expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)
  • expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)
  • expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)
  • expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)
  • expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)
  • expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)
  • expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)
  • expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Record
ALSA-2022:0951
Updated
2026-11-02
OSVASB-A-221255869 No score

In XML_GetBuffer of xmlparse.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Record
ASB-A-221255869
Updated
2026-11-05
OSVCLSA-2022-1660757175 No score

Fixed 15 CVEs in expat

  • CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
  • CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
  • CVE-2022-25315: Fix integer overflow in storeRawNames()
  • CVE-2022-22822: Fix integer overflow in addBinding()
  • CVE-2022-22823: Fix integer overflow in build_model()
  • CVE-2022-22824: Fix integer overflow in defineAttribute()
  • CVE-2022-22825: Fix integer overflow in lookup()
  • CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
  • CVE-2022-22827: Fix integer overflow in storeAtts()
  • CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
  • CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
  • CVE-2021-45960: Fix troublesome left shifts in storeAtts()
  • CVE-2022-23990: Fix integer overflow in doProlog()
  • CVE-2022-25313: Fix stack exhaustion in build_model()
  • CVE-2022-25314: Fix integer overflow in copyString()
Record
CLSA-2022-1660757175
Updated
2026-11-02
OSVCLSA-2022-1660758476 No score

Fixed 15 CVEs in expat

  • CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
  • CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
  • CVE-2022-25315: Fix integer overflow in storeRawNames()
  • CVE-2022-22822: Fix integer overflow in addBinding()
  • CVE-2022-22823: Fix integer overflow in build_model()
  • CVE-2022-22824: Fix integer overflow in defineAttribute()
  • CVE-2022-22825: Fix integer overflow in lookup()
  • CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
  • CVE-2022-22827: Fix integer overflow in storeAtts()
  • CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
  • CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
  • CVE-2021-45960: Fix troublesome left shifts in storeAtts()
  • CVE-2022-23990: Fix integer overflow in doProlog()
  • CVE-2022-25313: Fix stack exhaustion in build_model()
  • CVE-2022-25314: Fix integer overflow in copyString()
Record
CLSA-2022-1660758476
Updated
2026-11-02
OSVCLSA-2022-1660759632 No score

Fixed 13 CVEs in expat

  • CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
  • CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
  • CVE-2022-25315: Fix integer overflow in storeRawNames()
  • CVE-2022-22822: Fix integer overflow in addBinding()
  • CVE-2022-22823: Fix integer overflow in build_model()
  • CVE-2022-22824: Fix integer overflow in defineAttribute()
  • CVE-2022-22825: Fix integer overflow in lookup()
  • CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
  • CVE-2022-22827: Fix integer overflow in storeAtts()
  • CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
  • CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
  • CVE-2021-45960: Fix troublesome left shifts in storeAtts()
  • CVE-2022-23990: Fix integer overflow in doProlog()
Record
CLSA-2022-1660759632
Updated
2026-11-02
OSVCLSA-2022-1660760528 No score

Fix CVE(s): CVE-2022-25235, CVE-2022-23990, CVE-2022-22825, CVE-2022-22824, CVE-2022-23852, CVE-2022-25315, CVE-2022-25236, CVE-2021-46143, CVE-2022-25313, CVE-2021-45960, CVE-2022-22826, CVE-2022-22827, CVE-2022-22822, CVE-2022-22823

  • SECURITY UPDATE: Stack exhaustion
    • debian/patches/CVE-2022-25313.patch: prevent stack exhaustion in build_model in expat/lib/xmlparse.c.
    • debian/patches/fix-build_model-regression.patch: fix build_model regression in expat/lib/xmlparse.c.
    • CVE-2022-25313
  • SECURITY UPDATE: Integer overflow
    • debian/patches/CVE-2022-25315.patch: prevent integer overflow in storeRawNames in expat/lib/xmlparse.c.
    • CVE-2022-25315
  • SECURITY UPDATE: relax fix to CVE-2022-25236 with regard to RFC 3986 URI characters and possibly regressions
    • debian/patches/CVE-2022-25236-3.patch: add a note on namespace URI validation in expat/doc/reference.html, expat/lib/expat.h.
    • debian/patches/CVE-2022-25236-4.patch: document namespace separator effect right in header expat/lib/expat.h.
    • debian/patches/CVE-2022-25236-5.patch: cover relaxed fix in tests.
    • debian/patches/CVE-2022-25236-6.patch: relax fix with regard to RFC 3986 URI characters in expat/lib/xmlparse.c. (LP: #1963903)
  • fix tests adding XCS definition
    • debian/patches/fix_test_xcs.patch: in tests/runtests.c.
  • SECURITY UPDATE: Realloc misbehavior
    • debian/patches/CVE-2021-45960.patch: detect and prevent troublesome left shifts in function storeAtts in lib/xmlparse.c.
    • CVE-2021-45960
  • SECURITY UPDATE: Integer overflow
    • debian/patches/CVE-2021-46143.patch: prevent integer overflow on m_groupSize in function doProlog in lib/xmlparse.c.
    • CVE-2021-46143
  • SECURITY UPDATE: Integer overflow
    • debian/patches/CVE-2022-22822-to-CVE-2022-22827.patch: prevent integer overflow in multiple places in lib/xmlparse.c.
    • CVE-2022-22822
    • CVE-2022-22823
    • CVE-2022-22824
    • CVE-2022-22825
    • CVE-2022-22826
    • CVE-2022-22827
  • SECURITY UPDATE: Signed integer overflow
    • debian/patches/CVE-2022-23852-*.patch: detect and prevent integer overflow in XML_GetBuffer in expat/lib/xmlparse.c and adds test to cover it in tests/runtests.c.
    • CVE-2022-23852
  • SECURITY UPDATE: Integer overflow
    • debian/patches/CVE-2022-23990.patch: prevent integer overflow in doProlog in lib/xmlparse.c.
    • CVE-2022-23990
  • SECURITY UPDATE: Incomplete validation encoding
    • debian/patches/CVE-2022-25235-*.patch: adds missing validation and adds tests in expat/lib/xmltok_impl.c, expat/tests/runtests.c.
    • CVE-2022-25235
  • SECURITY UPDATE: Namespace-separator insertions
    • debian/patches/CVE-2022-25236-*.patch: Protect against malicious namespace declarations in expat/lib/xmlparse.c, expat/tests/runtests.c.
    • CVE-2022-25236
  • debian/patches/fixing_tests.patch: fixing tests in order to it work in xenial and oldest releases.
Record
CLSA-2022-1660760528
Updated
2026-11-02
OSVCLSA-2022-1660762248 No score

Fixed 13 CVEs in expat

  • CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
  • CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
  • CVE-2022-25315: Fix integer overflow in storeRawNames()
  • CVE-2022-22822: Fix integer overflow in addBinding()
  • CVE-2022-22823: Fix integer overflow in build_model()
  • CVE-2022-22824: Fix integer overflow in defineAttribute()
  • CVE-2022-22825: Fix integer overflow in lookup()
  • CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
  • CVE-2022-22827: Fix integer overflow in storeAtts()
  • CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
  • CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
  • CVE-2021-45960: Fix troublesome left shifts in storeAtts()
  • CVE-2022-23990: Fix integer overflow in doProlog()
Record
CLSA-2022-1660762248
Updated
2026-11-02
OSVMGASA-2022-0048 No score

Updated expat packages fix security vulnerability

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. (CVE-2022-23852)

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. (CVE-2022-23990)

Record
MGASA-2022-0048
Updated
2026-11-02
OSVopenSUSE-SU-2022:0498-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054).
  • CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217).
Record
openSUSE-SU-2022:0498-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11793-1 No score

expat-2.4.4-1.1 on GA media

These are all security issues fixed in the expat-2.4.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11793-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11985-1 No score

libQt5Pdf5-5.15.9-1.1 on GA media

These are all security issues fixed in the libQt5Pdf5-5.15.9-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11985-1
Updated
2026-11-02
OSVSUSE-SU-2022:0495-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054).
  • CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217).
Record
SUSE-SU-2022:0495-1
Updated
2026-11-02
OSVSUSE-SU-2022:0498-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054).
  • CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217).
Record
SUSE-SU-2022:0498-1
Updated
2026-11-02
OSVSUSE-SU-2022:14884-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054).
  • CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217).
Record
SUSE-SU-2022:14884-1
Updated
2026-11-02
OSVUSN-5288-1 No score

expat vulnerabilities

It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code.

Record
USN-5288-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
expat
Alpine:v3.12
 before 2.2.10-r1
2.2.10-r1
expat
Alpine:v3.13
 before 2.2.10-r3
2.2.10-r3
expat
Alpine:v3.14
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.15
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.16
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.17
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.18
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.19
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.20
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.21
 before 2.4.4-r0
2.4.4-r0
Show 178 moreShow less
Affected packages
PackageAffectedFixed
expat
Alpine:v3.22
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.23
 before 2.4.4-r0
2.4.4-r0
expat
Alpine:v3.24
 before 2.4.4-r0
2.4.4-r0
qt5-qtwebengine
Alpine:v3.15
 before 5.15.3_git20211127-r4
5.15.3_git20211127-r4
qt5-qtwebengine
Alpine:v3.16
 before 5.15.3_git20220121-r4
5.15.3_git20220121-r4
qt5-qtwebengine
Alpine:v3.17
 before 5.15.3_git20220121-r4
5.15.3_git20220121-r4
qt5-qtwebengine
Alpine:v3.18
 before 5.15.3_git20220121-r4
5.15.3_git20220121-r4
qt5-qtwebengine
Alpine:v3.19
 before 5.15.3_git20220121-r4
5.15.3_git20220121-r4
qt5-qtwebengine
Alpine:v3.20
 before 5.15.3_git20220121-r4
5.15.3_git20220121-r4
qt5-qtwebengine
Alpine:v3.21
 before 5.15.3_git20220121-r4
5.15.3_git20220121-r4
qt5-qtwebengine
Alpine:v3.22
 before 5.15.3_git20220121-r4
5.15.3_git20220121-r4
qt5-qtwebengine
Alpine:v3.23
 before 5.15.3_git20220121-r4
5.15.3_git20220121-r4
expat
AlmaLinux:8
From an advisory covering 12 CVEs
 before 2.2.5-8.el8_6.2
2.2.5-8.el8_6.2
expat-devel
AlmaLinux:8
From an advisory covering 12 CVEs
 before 2.2.5-8.el8_6.2
2.2.5-8.el8_6.2
platform/external/expat
Android
 10:0 up to 10:2022-09-01, plus listed versions
10
10:2022-09-01
platform/external/expat
Android
 11:0 up to 11:2022-09-01, plus listed versions
11
11:2022-09-01
platform/external/expat
Android
 12:0 up to 12:2022-09-01, plus listed versions
12
12:2022-09-01
platform/external/expat
Android
 12L:0 up to 12L:2022-09-01, plus listed versions
12L
12L:2022-09-01
expat
Azure Linux:2
 before 2.4.8-1
2.4.8-1
expat
TuxCare:CentOS:8.4
From an advisory covering 15 CVEs
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat-devel
TuxCare:CentOS:8.4
From an advisory covering 15 CVEs
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat-static
TuxCare:CentOS:8.4
From an advisory covering 15 CVEs
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat
TuxCare:CentOS:8.5
From an advisory covering 15 CVEs
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat-devel
TuxCare:CentOS:8.5
From an advisory covering 15 CVEs
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat-static
TuxCare:CentOS:8.5
From an advisory covering 15 CVEs
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat
TuxCare:OracleLinux:6
From an advisory covering 13 CVEs
 before 2.0.1-13.el6_8.tuxcare.els1
2.0.1-13.el6_8.tuxcare.els1
expat-devel
TuxCare:OracleLinux:6
From an advisory covering 13 CVEs
 before 2.0.1-13.el6_8.tuxcare.els1
2.0.1-13.el6_8.tuxcare.els1
expat
TuxCare:Ubuntu:16.04
From an advisory covering 14 CVEs
 before 2.1.0-7ubuntu0.16.04.5+tuxcare.els1
2.1.0-7ubuntu0.16.04.5+tuxcare.els1
libexpat1
TuxCare:Ubuntu:16.04
From an advisory covering 14 CVEs
 before 2.1.0-7ubuntu0.16.04.5+tuxcare.els1
2.1.0-7ubuntu0.16.04.5+tuxcare.els1
libexpat1-dev
TuxCare:Ubuntu:16.04
From an advisory covering 14 CVEs
 before 2.1.0-7ubuntu0.16.04.5+tuxcare.els1
2.1.0-7ubuntu0.16.04.5+tuxcare.els1
expat
TuxCare:CentOS:6
From an advisory covering 13 CVEs
 before 2.0.1-13.el6_8.tuxcare.els1
2.0.1-13.el6_8.tuxcare.els1
expat-devel
TuxCare:CentOS:6
From an advisory covering 13 CVEs
 before 2.0.1-13.el6_8.tuxcare.els1
2.0.1-13.el6_8.tuxcare.els1
expat
Debian:12
 before 2.4.3-2
2.4.3-2
expat
Debian:13
 before 2.4.3-2
2.4.3-2
expat
Debian:14
 before 2.4.3-2
2.4.3-2
libxmltok
Debian:12
 All versions, plus listed versions
1.2-41.2-4.11.2-4.1~exp11.2-4.2
 None known
expat
Debian:9
From an advisory covering 10 CVEs
 before 2.2.0-2+deb9u4, plus listed versions
2.2.0-22.2.0-2+deb9u12.2.0-2+deb9u22.2.0-2+deb9u3
2.2.0-2+deb9u4
expat
Debian:9
From an advisory covering 5 CVEs
 before 2.2.0-2+deb9u5, plus listed versions
2.2.0-22.2.0-2+deb9u12.2.0-2+deb9u22.2.0-2+deb9u32.2.0-2+deb9u4
2.2.0-2+deb9u5
expat
Debian:10
From an advisory covering 10 CVEs
 before 2.2.6-2+deb10u2, plus listed versions
2.2.6-22.2.6-2+deb10u1
2.2.6-2+deb10u2
expat
Debian:11
From an advisory covering 10 CVEs
 before 2.2.10-2+deb11u1, plus listed versions
2.2.10-2
2.2.10-2+deb11u1
Expat_jll
Julia
 before 2.4.4+0
2.4.4+0
expat
Mageia:8
From an advisory covering 2 CVEs
 before 2.2.10-1.2.mga8
2.2.10-1.2.mga8
expat
openEuler:20.03-LTS-SP1
From an advisory covering 2 CVEs
 before 2.2.9-5.oe1
2.2.9-5.oe1
expat
openEuler:20.03-LTS-SP2
From an advisory covering 2 CVEs
 before 2.2.9-5.oe1
2.2.9-5.oe1
expat
openEuler:20.03-LTS-SP3
From an advisory covering 2 CVEs
 before 2.2.9-5.oe1
2.2.9-5.oe1
expat-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat
Red Hat:enterprise_linux:9::baseos
From an advisory covering 11 CVEs
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 11 CVEs
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 11 CVEs
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat
Red Hat:enterprise_linux:8::baseos
From an advisory covering 12 CVEs
 before 0:2.2.5-4.el8_5.3
0:2.2.5-4.el8_5.3
expat-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 12 CVEs
 before 0:2.2.5-4.el8_5.3
0:2.2.5-4.el8_5.3
expat-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 12 CVEs
 before 0:2.2.5-4.el8_5.3
0:2.2.5-4.el8_5.3
expat-devel
Red Hat:enterprise_linux:8::baseos
From an advisory covering 12 CVEs
 before 0:2.2.5-4.el8_5.3
0:2.2.5-4.el8_5.3
expat
Red Hat:enterprise_linux:7::client
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-devel
Red Hat:enterprise_linux:7::client
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-static
Red Hat:enterprise_linux:7::client
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-debuginfo
Red Hat:enterprise_linux:7::computenode
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-devel
Red Hat:enterprise_linux:7::computenode
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-static
Red Hat:enterprise_linux:7::computenode
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat
Red Hat:enterprise_linux:7::server
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-devel
Red Hat:enterprise_linux:7::server
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-static
Red Hat:enterprise_linux:7::server
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat
Red Hat:enterprise_linux:7::workstation
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-devel
Red Hat:enterprise_linux:7::workstation
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-static
Red Hat:enterprise_linux:7::workstation
From an advisory covering 12 CVEs
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat
Red Hat:rhel_eus:8.4::baseos
 before 0:2.2.5-4.el8_4.3
0:2.2.5-4.el8_4.3
expat-debuginfo
Red Hat:rhel_eus:8.4::baseos
 before 0:2.2.5-4.el8_4.3
0:2.2.5-4.el8_4.3
expat-debugsource
Red Hat:rhel_eus:8.4::baseos
 before 0:2.2.5-4.el8_4.3
0:2.2.5-4.el8_4.3
expat-devel
Red Hat:rhel_eus:8.4::baseos
 before 0:2.2.5-4.el8_4.3
0:2.2.5-4.el8_4.3
expat
Rocky Linux:8
From an advisory covering 12 CVEs
 before 0:2.2.5-4.el8_5.3
0:2.2.5-4.el8_5.3
expat
SUSE:HPE Helion OpenStack 8
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:OpenStack Cloud 8
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 2 CVEs
 before 2.1.0-21.15.1
2.1.0-21.15.1
expat
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise High Performance Computing 15-LTSS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Real Time 15 SP2
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server 15-LTSS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Manager Proxy 4.1
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Manager Server 4.1
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Micro 5.0
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Micro 5.1
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Enterprise Storage 6
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Enterprise Storage 7
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 2 CVEs
 before 2.0.1-88.42.15.1
2.0.1-88.42.15.1
expat
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 2 CVEs
 before 2.0.1-88.42.15.1
2.0.1-88.42.15.1
expat
Ubuntu:Pro:14.04:LTS
 before 2.1.0-4ubuntu1.4+esm4, plus listed versions
2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.12.1.0-4ubuntu1.22.1.0-4ubuntu1.32.1.0-4ubuntu1.42.1.0-4ubuntu1.4+esm12.1.0-4ubuntu1.4+esm2
2.1.0-4ubuntu1.4+esm4
coin3
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50-33.1.4~abc9f50-43.1.4~abc9f50-4ubuntu23.1.4~abc9f50-4ubuntu2+esm13.1.4~abc9f50-4ubuntu2+esm2
 None known
vnc4
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37ubuntu54.1.1+xorg4.3.0-37ubuntu5.0.14.1.1+xorg4.3.0-37ubuntu5.0.24.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
 None known
vtk
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
5.8.0-14ubuntu15.8.0-14ubuntu35.8.0-14.1ubuntu25.8.0-14.1ubuntu35.8.0-14.1ubuntu3+esm1
 None known
expat
Ubuntu:Pro:16.04:LTS
 before 2.1.0-7ubuntu0.16.04.5+esm2, plus listed versions
2.1.0-72.1.0-7ubuntu0.16.04.12.1.0-7ubuntu0.16.04.22.1.0-7ubuntu0.16.04.32.1.0-7ubuntu0.16.04.42.1.0-7ubuntu0.16.04.5
2.1.0-7ubuntu0.16.04.5+esm2
cableswig
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.1.0+git20150808-10.1.0+git20150808-20.1.0+git20150808-2ubuntu0.1~esm1
 None known
coin3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
 None known
insighttoolkit
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.20.1+git20120521-63.20.1+git20120521-6build13.20.1+git20120521-6ubuntu0.1~esm1
 None known
insighttoolkit4
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.8.1-1ubuntu34.8.1-1ubuntu44.8.2-3.1ubuntu14.9.0-3ubuntu24.9.0-4ubuntu14.9.0-4ubuntu1.1
 None known
tdom
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.8.3-1
 None known
vnc4
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu24.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
 None known
vtk
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.10.1+dfsg-25.10.1+dfsg-2build35.10.1+dfsg-2.1build15.10.1+dfsg-2.1ubuntu0.1~esm1
 None known
wbxml2
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.10.7-1
 None known
expat
Ubuntu:18.04:LTS
 before 2.2.5-3ubuntu0.4, plus listed versions
2.2.3-12.2.3-22.2.5-0ubuntu22.2.5-32.2.5-3ubuntu0.12.2.5-3ubuntu0.2
2.2.5-3ubuntu0.4
coin3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-23.1.4~abc9f50+dfsg2-13.1.4~abc9f50+dfsg3-13.1.4~abc9f50+dfsg3-23.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
 None known
tdom
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.8.3-10.9.0-1
 None known
vnc4
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu2
 None known
wbxml2
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.10.7-10.10.7-1build1
 None known
expat
Ubuntu:20.04:LTS
 before 2.2.9-1ubuntu0.2, plus listed versions
2.2.7-22.2.9-12.2.9-1build1
2.2.9-1ubuntu0.2
tdom
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.9.1-1
 None known
wbxml2
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.10.7-1build1
 None known
cadaver
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.23.3-2.1build1
 None known
expat
Ubuntu:22.04:LTS
 before 2.4.3-2, plus listed versions
2.4.1-22.4.1-32.4.2-12.4.3-1
2.4.3-2
firefox
Ubuntu:22.04:LTS
 before 1:1snap1-0ubuntu1, plus listed versions
93.0+build1-0ubuntu394.0+build3-0ubuntu194.0.2+build1-0ubuntu194.0.2+build2-0ubuntu195.0+build1-0ubuntu1
Show 9 moreShow less
95.0.1+build2-0ubuntu195.0.2+build1-0ubuntu196.0+build2-0ubuntu196.0.1+build1-0ubuntu196.0.2+build1-0ubuntu196.0.3+build1-0ubuntu197.0+build1-0ubuntu197.0+build2-0ubuntu197.0.1+build1-0ubuntu1
1:1snap1-0ubuntu1
matanza
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.13+ds2-1
 None known
tdom
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.9.2-1
 None known
thunderbird
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 34 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1
 None known
wbxml2
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.10.7-1build10.11.7+dfsg-1
 None known
swish-e
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.4.7-6build32.4.7-6.12.4.7-6.1build12.4.7-6.1ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.33.14-91.33.14-101.33.14-10ubuntu0.1~esm1
 None known
cadaver
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.24+dfsg-20.24+dfsg-30.24+dfsg-3build10.24+dfsg-3build2
 None known
matanza
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.13+ds2-10.13+ds2-1build10.13+ds2-1build2
 None known
tdom
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.9.3-10.9.3-1build1
 None known
thunderbird
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:115.3.1+build1-0ubuntu11:115.4.1+build1-0ubuntu11:115.4.3+build1-0ubuntu11:115.5.0+build1-0ubuntu11:115.5.1+build1-0ubuntu1
Show 9 moreShow less
1:115.5.2+build2-0ubuntu11:115.6.0+build1-0ubuntu11:115.6.0+build2-0ubuntu11:115.6.1+build1-0ubuntu11:115.8.0+build1-0ubuntu11:115.8.1+build1+snap21:115.8.1+build1+snap32:1snap1-0ubuntu12:1snap1-0ubuntu3
 None known
wbxml2
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.11.8+dfsg-30.11.8+dfsg-3build1
 None known
swish-e
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.4.7-6.22.4.7-6.2build12.4.7-6.2build22.4.7-6.2build32.4.7-6.2ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.33.14-111.33.14-11.11.33.14-121.33.14-12build11.33.14-12build21.33.14-12ubuntu0.1~esm1
 None known
cadaver
Ubuntu:25.10
 All versions, plus listed versions
0.26+dfsg-2
 None known
matanza
Ubuntu:25.10
 All versions, plus listed versions
0.13+ds2-2
 None known
swish-e
Ubuntu:25.10
 All versions, plus listed versions
2.4.7-6.32.4.7-6.3build12.4.7-7
 None known
tdom
Ubuntu:25.10
 All versions, plus listed versions
0.9.5.1-20.9.5.1-3
 None known
thunderbird
Ubuntu:25.10
 All versions, plus listed versions
2:1snap1-0ubuntu3
 None known
wbxml2
Ubuntu:25.10
 All versions, plus listed versions
0.11.10+dfsg-2
 None known
xmlrpc-c
Ubuntu:25.10
 All versions, plus listed versions
1.59.03-71.59.03-91.59.03-101.59.03-10.1
 None known
cadaver
Ubuntu:26.10
 All versions, plus listed versions
0.28+dfsg-2
 None known
matanza
Ubuntu:26.10
 All versions, plus listed versions
0.13+ds2-2build1
 None known
swish-e
Ubuntu:26.10
 All versions, plus listed versions
2.4.7-7.12.4.7-7.22.4.7-7.2build1
 None known
tdom
Ubuntu:26.10
 All versions, plus listed versions
0.9.6-20.9.6-3
 None known
thunderbird
Ubuntu:26.10
 All versions, plus listed versions
2:1snap1-0ubuntu5
 None known
wbxml2
Ubuntu:26.10
 All versions, plus listed versions
0.11.10+dfsg-30.11.10+dfsg-4
 None known
xmlrpc-c
Ubuntu:26.10
 All versions, plus listed versions
1.60.05-11.60.05-1build1
 None known
cadaver
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.26+dfsg-20.28+dfsg-10.28+dfsg-2
 None known
matanza
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.13+ds2-20.13+ds2-2build1
 None known
tdom
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.9.5.1-30.9.6-2
 None known
thunderbird
Ubuntu:26.04:LTS
 All versions, plus listed versions
2:1snap1-0ubuntu32:1snap1-0ubuntu42:1snap1-0ubuntu5
 None known
wbxml2
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.11.10+dfsg-20.11.10+dfsg-2build10.11.10+dfsg-3
 None known
xmlrpc-c
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.59.03-10.11.60.05-1
 None known
swish-e
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.4.7-72.4.7-7.12.4.7-7.1ubuntu0.1~esm1
 None known
expat
Ubuntu:Pro:14.04:LTS
From an advisory covering 12 CVEs
 before 2.1.0-4ubuntu1.4+esm4, plus listed versions
2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.12.1.0-4ubuntu1.22.1.0-4ubuntu1.32.1.0-4ubuntu1.42.1.0-4ubuntu1.4+esm12.1.0-4ubuntu1.4+esm2
2.1.0-4ubuntu1.4+esm4
expat
Ubuntu:Pro:16.04:LTS
From an advisory covering 12 CVEs
 before 2.1.0-7ubuntu0.16.04.5+esm2, plus listed versions
2.1.0-72.1.0-7ubuntu0.16.04.12.1.0-7ubuntu0.16.04.22.1.0-7ubuntu0.16.04.32.1.0-7ubuntu0.16.04.42.1.0-7ubuntu0.16.04.5
2.1.0-7ubuntu0.16.04.5+esm2
expat
Ubuntu:18.04:LTS
From an advisory covering 12 CVEs
 before 2.2.5-3ubuntu0.4, plus listed versions
2.2.3-12.2.3-22.2.5-0ubuntu22.2.5-32.2.5-3ubuntu0.12.2.5-3ubuntu0.2
2.2.5-3ubuntu0.4
expat
Ubuntu:20.04:LTS
From an advisory covering 12 CVEs
 before 2.2.9-1ubuntu0.2, plus listed versions
2.2.7-22.2.9-12.2.9-1build1
2.2.9-1ubuntu0.2
expat
openSUSE:Leap 15.3
From an advisory covering 2 CVEs
 before 2.2.5-3.12.1
2.2.5-3.12.1
expat
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 2.4.4-1.1
2.4.4-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubSatheesh575555/external_expat_AOSP10_r33_CVE-2022-238522022-05-10

History

History
RecordedChangedSources
affected
factsOSV
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-23852 is a critical vulnerability (CVSS 9.8) in Libexpat Project Libexpat, published January 24, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.08%, the 92nd percentile. Fixed in expat 2.2.10-r1.

References

Show 146 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open