Every CVE Search/ Get API key

CVE-2025-59375

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a...

7.5 HighFix available

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.38%Up 1.3 points since Sep 15, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Record
CVE-2025-59375
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:T/RC:C
Weakness
CWE-770
Updated
2026-11-02
EUVDEUVD-2025-29148 7.5

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Record
EUVD-2025-29148
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:T/RC:C
Updated
2026-11-02
GitHub AdvisoriesGHSA-vjqp-pjp6-xcxx 7.5

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a...

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Record
GHSA-vjqp-pjp6-xcxx
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
NVD 7.5

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Record
CVE-2025-59375
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-770
Updated
2026-11-02
OSVALPINE-CVE-2025-59375 7.5

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Record
ALPINE-CVE-2025-59375
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2025-59375 7.5
Record
BELL-CVE-2025-59375
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 48 moreShow less
OSV 7.5

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Record
CVE-2025-59375
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:T/RC:C
Weakness
CWE-770
Updated
2026-11-07
OSVDEBIAN-CVE-2025-59375 7.5

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Record
DEBIAN-CVE-2025-59375
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVJLSEC-2025-173 7.5

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a...

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Record
JLSEC-2025-173
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2454 7.5

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

libexpat in Expat before version 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document submitted for parsing, leading to resource exhaustion.(CVE-2025-59375)

Record
OESA-2025-2454
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2455 7.5

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

libexpat in Expat before version 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document submitted for parsing, leading to resource exhaustion.(CVE-2025-59375)

Record
OESA-2025-2455
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2456 7.5

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

libexpat in Expat before version 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document submitted for parsing, leading to resource exhaustion.(CVE-2025-59375)

Record
OESA-2025-2456
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2457 7.5

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

libexpat in Expat before version 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document submitted for parsing, leading to resource exhaustion.(CVE-2025-59375)

Record
OESA-2025-2457
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2458 7.5

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

libexpat in Expat before version 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document submitted for parsing, leading to resource exhaustion.(CVE-2025-59375)

Record
OESA-2025-2458
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2025-2459 7.5

expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.

Security Fix(es):

libexpat in Expat before version 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document submitted for parsing, leading to resource exhaustion.(CVE-2025-59375)

Record
OESA-2025-2459
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1705 10.0

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.(CVE-2025-59375)

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4684)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4685)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4686)

Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4687)

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4688)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4689)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4690)

Use-after-free in the CSS Parsing and Computation component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4691)

Sandbox escape in the Responsive Design Mode component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4692)

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4693)

Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4694)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4695)

Use-after-free in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4696)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4697)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4698)

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4699)

Mitigation bypass in the Networking: HTTP component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4700)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4701)

JIT miscompilation in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4702)

Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4704)

Undefined behavior in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR…

Record
OESA-2026-1705
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-1706 10.0

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.(CVE-2025-59375)

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4684)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4685)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4686)

Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4687)

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4688)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4689)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4690)

Use-after-free in the CSS Parsing and Computation component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4691)

Sandbox escape in the Responsive Design Mode component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4692)

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4693)

Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4694)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4695)

Use-after-free in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4696)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4697)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4698)

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4699)

Mitigation bypass in the Networking: HTTP component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4700)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4701)

JIT miscompilation in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4702)

Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4704)

Undefined behavior in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR…

Record
OESA-2026-1706
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-1707 10.0

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.(CVE-2025-59375)

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4684)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4685)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4686)

Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4687)

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4688)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4689)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4690)

Use-after-free in the CSS Parsing and Computation component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4691)

Sandbox escape in the Responsive Design Mode component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4692)

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4693)

Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4694)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4695)

Use-after-free in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4696)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4697)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4698)

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4699)

Mitigation bypass in the Networking: HTTP component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4700)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4701)

JIT miscompilation in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4702)

Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4704)

Undefined behavior in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR…

Record
OESA-2026-1707
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-1708 10.0

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.(CVE-2025-59375)

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4684)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4685)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4686)

Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4687)

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4688)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4689)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4690)

Use-after-free in the CSS Parsing and Computation component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4691)

Sandbox escape in the Responsive Design Mode component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4692)

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4693)

Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4694)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4695)

Use-after-free in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4696)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4697)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4698)

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4699)

Mitigation bypass in the Networking: HTTP component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4700)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4701)

JIT miscompilation in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4702)

Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4704)

Undefined behavior in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR…

Record
OESA-2026-1708
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-1709 10.0

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.(CVE-2025-59375)

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4684)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4685)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4686)

Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4687)

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4688)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4689)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4690)

Use-after-free in the CSS Parsing and Computation component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4691)

Sandbox escape in the Responsive Design Mode component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4692)

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4693)

Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4694)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4695)

Use-after-free in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4696)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4697)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4698)

Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, and Firefox ESR < 140.9.(CVE-2026-4699)

Mitigation bypass in the Networking: HTTP component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4700)

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4701)

JIT miscompilation in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4702)

Denial-of-service in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR < 140.9.(CVE-2026-4704)

Undefined behavior in the WebRTC: Signaling component. This vulnerability affects Firefox < 149 and Firefox ESR…

Record
OESA-2026-1709
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-1993 10.0

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.(CVE-2025-59375)

Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.(CVE-2026-3889)

A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.(CVE-2026-4371)

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4684)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4685)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4686)

Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4687)

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4688)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4689)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.(CVE-2026-4690)

Use-after-free in the CSS Parsing and Computation component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4691)

Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.(CVE-2026-4692)

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4693)

Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.(CVE-2026-4694)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4695)

Use-after-free in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4696)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4697)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 149, Firefox ESR <…

Record
OESA-2026-1993
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-1994 10.0

thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.(CVE-2025-59375)

Spoofing issue in Thunderbird. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.(CVE-2026-3889)

A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.(CVE-2026-4371)

Race condition, use-after-free in the Graphics: WebRender component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4684)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4685)

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4686)

Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4687)

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4688)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4689)

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.(CVE-2026-4690)

Use-after-free in the CSS Parsing and Computation component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4691)

Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.(CVE-2026-4692)

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4693)

Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.(CVE-2026-4694)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4695)

Use-after-free in the Layout: Text and Fonts component. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4696)

Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability affects Firefox < 149, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbird < 140.9.(CVE-2026-4697)

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability affects Firefox < 149, Firefox ESR <…

Record
OESA-2026-1994
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:19403 5.3

Red Hat Security Advisory: expat security update

Record
RHSA-2025:19403
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2025:21030 5.3

Red Hat Security Advisory: expat security update

Record
RHSA-2025:21030
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2025:21773 5.3

Red Hat Security Advisory: expat security update

Record
RHSA-2025:21773
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2025:21776 7.5

Red Hat Security Advisory: expat security update

Record
RHSA-2025:21776
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:21974 5.3

Red Hat Security Advisory: mingw-expat security update

Record
RHSA-2025:21974
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2025:22033 7.5

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22033
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:22034 7.5

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22034
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:22035 7.5

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22035
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:22175 5.3

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22175
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2025:22607 7.5

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22607
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:22785 9.8

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22785
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22842 7.5

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22842
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:22871 9.8

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22871
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:0001 8.8

Red Hat Security Advisory: spice-client-win security update

Record
RHSA-2026:0001
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:0076 8.8

Red Hat Security Advisory: spice-client-win security update

Record
RHSA-2026:0076
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:0077 8.8

Red Hat Security Advisory: spice-client-win security update

Record
RHSA-2026:0077
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:0078 8.8

Red Hat Security Advisory: spice-client-win security update

Record
RHSA-2026:0078
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:10950 8.1

Red Hat Security Advisory: python3.12 security update

Record
RHSA-2026:10950
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:19064 8.1

Red Hat Security Advisory: python3.12 security update

Record
RHSA-2026:19064
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:19177 8.1

Red Hat Security Advisory: python3.12 security update

Record
RHSA-2026:19177
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:3407 5.3

Red Hat Security Advisory: mingw-fontconfig security update

Record
RHSA-2026:3407
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2026:5396 5.3

Red Hat Security Advisory: Red Hat Hardened Images RPM Release

Record
RHSA-2026:5396
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2025:19403 5.3

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:19403
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2025:21776 5.3

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:21776
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2025:21974 5.3

Important: mingw-expat security update

Expat is a C library for parsing XML documents. The mingw-expat packages provide a port of the Expat library for MinGW.

Security Fix(es):

  • expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:21974
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2025:22175 5.3

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:22175
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2026:10950 8.1

Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

  • python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

  • cpython: Out-of-memory when loading Plist (CVE-2025-13837)

  • cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

  • cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

  • cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

  • cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

  • cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

  • python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

  • python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

  • python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:10950
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:19064 8.1

Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

  • python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

  • cpython: Out-of-memory when loading Plist (CVE-2025-13837)

  • cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

  • cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

  • cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

  • cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

  • cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

  • python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

  • python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

  • python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

  • python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19064
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:19177 8.1

Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

  • expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

  • python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)

  • cpython: Out-of-memory when loading Plist (CVE-2025-13837)

  • cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)

  • cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)

  • cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

  • cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

  • cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

  • python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

  • python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

  • python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

  • python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19177
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:3407 5.3

Important: mingw-fontconfig security update

MinGW Windows Fontconfig library.

Security Fix(es):

  • expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:3407
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2025-59375 7.5

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Record
UBUNTU-CVE-2025-59375
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2025:19403 No score

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:19403
Updated
2026-11-02

Affected products

Show 9 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
expat
Alpine:v3.19
 before 2.7.2-r0
2.7.2-r0
expat
Alpine:v3.20
 before 2.7.2-r0
2.7.2-r0
expat
Alpine:v3.21
 before 2.7.2-r0
2.7.2-r0
expat
Alpine:v3.22
 before 2.7.2-r0
2.7.2-r0
expat
Alpine:v3.23
 before 2.7.2-r0
2.7.2-r0
expat
Alpine:v3.24
 before 2.7.2-r0
2.7.2-r0
expat
AlmaLinux:10
 before 2.7.1-1.el10_0.3
2.7.1-1.el10_0.3
expat-devel
AlmaLinux:10
 before 2.7.1-1.el10_0.3
2.7.1-1.el10_0.3
expat
AlmaLinux:10
 before 2.7.1-1.el10_1.3
2.7.1-1.el10_1.3
expat-devel
AlmaLinux:10
 before 2.7.1-1.el10_1.3
2.7.1-1.el10_1.3
Show 290 moreShow less
Affected packages
PackageAffectedFixed
expat
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.5.0-1.el8_10
2.5.0-1.el8_10
expat-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 2.5.0-1.el8_10
2.5.0-1.el8_10
mingw32-expat
AlmaLinux:8
 before 2.5.0-1.el8_10
2.5.0-1.el8_10
mingw64-expat
AlmaLinux:8
 before 2.5.0-1.el8_10
2.5.0-1.el8_10
expat
AlmaLinux:9
 before 2.5.0-5.el9_7.1
2.5.0-5.el9_7.1
expat-devel
AlmaLinux:9
 before 2.5.0-5.el9_7.1
2.5.0-5.el9_7.1
python3.12
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.12.13-2.el8_10
3.12.13-2.el8_10
python3.12-debug
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.12.13-2.el8_10
3.12.13-2.el8_10
python3.12-devel
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.12.13-2.el8_10
3.12.13-2.el8_10
python3.12-idle
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.12.13-2.el8_10
3.12.13-2.el8_10
python3.12-libs
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.12.13-2.el8_10
3.12.13-2.el8_10
python3.12-rpm-macros
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.12.13-2.el8_10
3.12.13-2.el8_10
python3.12-test
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.12.13-2.el8_10
3.12.13-2.el8_10
python3.12-tkinter
AlmaLinux:8
From an advisory covering 11 CVEs
 before 3.12.13-2.el8_10
3.12.13-2.el8_10
python-unversioned-command
AlmaLinux:10
From an advisory covering 12 CVEs
 before 3.12.13-2.el10_2
3.12.13-2.el10_2
python3
AlmaLinux:10
From an advisory covering 12 CVEs
 before 3.12.13-2.el10_2
3.12.13-2.el10_2
python3-debug
AlmaLinux:10
From an advisory covering 12 CVEs
 before 3.12.13-2.el10_2
3.12.13-2.el10_2
python3-devel
AlmaLinux:10
From an advisory covering 12 CVEs
 before 3.12.13-2.el10_2
3.12.13-2.el10_2
python3-idle
AlmaLinux:10
From an advisory covering 12 CVEs
 before 3.12.13-2.el10_2
3.12.13-2.el10_2
python3-libs
AlmaLinux:10
From an advisory covering 12 CVEs
 before 3.12.13-2.el10_2
3.12.13-2.el10_2
python3-test
AlmaLinux:10
From an advisory covering 12 CVEs
 before 3.12.13-2.el10_2
3.12.13-2.el10_2
python3-tkinter
AlmaLinux:10
From an advisory covering 12 CVEs
 before 3.12.13-2.el10_2
3.12.13-2.el10_2
python3.12
AlmaLinux:9
From an advisory covering 12 CVEs
 before 3.12.13-2.el9_8
3.12.13-2.el9_8
python3.12-debug
AlmaLinux:9
From an advisory covering 12 CVEs
 before 3.12.13-2.el9_8
3.12.13-2.el9_8
python3.12-devel
AlmaLinux:9
From an advisory covering 12 CVEs
 before 3.12.13-2.el9_8
3.12.13-2.el9_8
python3.12-idle
AlmaLinux:9
From an advisory covering 12 CVEs
 before 3.12.13-2.el9_8
3.12.13-2.el9_8
python3.12-libs
AlmaLinux:9
From an advisory covering 12 CVEs
 before 3.12.13-2.el9_8
3.12.13-2.el9_8
python3.12-test
AlmaLinux:9
From an advisory covering 12 CVEs
 before 3.12.13-2.el9_8
3.12.13-2.el9_8
python3.12-tkinter
AlmaLinux:9
From an advisory covering 12 CVEs
 before 3.12.13-2.el9_8
3.12.13-2.el9_8
mingw32-fontconfig
AlmaLinux:8
 before 2.12.6-4.el8_10
2.12.6-4.el8_10
mingw64-fontconfig
AlmaLinux:8
 before 2.12.6-4.el8_10
2.12.6-4.el8_10
expat
Azure Linux:3
 before 2.6.4-2
2.6.4-2
expat
Azure Linux:2
 before 2.6.4-2
2.6.4-2
expat
Alpaquita:23
 2.5.0-r0 up to 2.7.2-r0
2.7.2-r0
expat
Alpaquita:25
 2.7.1-r0 up to 2.7.2-r0
2.7.2-r0
expat
Alpaquita:stream
 2.4.9-r0 up to 2.7.2-r0
2.7.2-r0
expat
BellSoft Hardened Containers:23
 2.5.0-r0 up to 2.7.2-r0
2.7.2-r0
expat
BellSoft Hardened Containers:25
 2.7.1-r0 up to 2.7.2-r0
2.7.2-r0
expat
BellSoft Hardened Containers:stream
 2.4.9-r0 up to 2.7.2-r0
2.7.2-r0
expat
TuxCare:AlmaLinux:9.2
 before 2.5.0-1.el9.tuxcare.els6
2.5.0-1.el9.tuxcare.els6
expat-devel
TuxCare:AlmaLinux:9.2
 before 2.5.0-1.el9.tuxcare.els6
2.5.0-1.el9.tuxcare.els6
expat-static
TuxCare:AlmaLinux:9.2
 before 2.5.0-1.el9.tuxcare.els6
2.5.0-1.el9.tuxcare.els6
expat
TuxCare:AlmaLinux:9.6
 before 2.5.0-5.el9_6.tuxcare.els1
2.5.0-5.el9_6.tuxcare.els1
expat-devel
TuxCare:AlmaLinux:9.6
 before 2.5.0-5.el9_6.tuxcare.els1
2.5.0-5.el9_6.tuxcare.els1
expat-static
TuxCare:AlmaLinux:9.6
 before 2.5.0-5.el9_6.tuxcare.els1
2.5.0-5.el9_6.tuxcare.els1
expat
TuxCare:CentOS-Stream:8
From an advisory covering 3 CVEs
 before 2.5.0-1.el8.tuxcare.els1
2.5.0-1.el8.tuxcare.els1
expat-devel
TuxCare:CentOS-Stream:8
From an advisory covering 3 CVEs
 before 2.5.0-1.el8.tuxcare.els1
2.5.0-1.el8.tuxcare.els1
expat-static
TuxCare:CentOS-Stream:8
From an advisory covering 3 CVEs
 before 2.5.0-1.el8.tuxcare.els1
2.5.0-1.el8.tuxcare.els1
expat
TuxCare:CentOS:8.4
From an advisory covering 3 CVEs
 before 2.5.0-1.el8.tuxcare.els1
2.5.0-1.el8.tuxcare.els1
expat-devel
TuxCare:CentOS:8.4
From an advisory covering 3 CVEs
 before 2.5.0-1.el8.tuxcare.els1
2.5.0-1.el8.tuxcare.els1
expat-static
TuxCare:CentOS:8.4
From an advisory covering 3 CVEs
 before 2.5.0-1.el8.tuxcare.els1
2.5.0-1.el8.tuxcare.els1
expat
TuxCare:CentOS:8.5
From an advisory covering 3 CVEs
 before 2.5.0-1.el8.tuxcare.els1
2.5.0-1.el8.tuxcare.els1
expat-devel
TuxCare:CentOS:8.5
From an advisory covering 3 CVEs
 before 2.5.0-1.el8.tuxcare.els1
2.5.0-1.el8.tuxcare.els1
expat-static
TuxCare:CentOS:8.5
From an advisory covering 3 CVEs
 before 2.5.0-1.el8.tuxcare.els1
2.5.0-1.el8.tuxcare.els1
expat
Debian:12
 before 2.5.0-1+deb12u5, plus listed versions
2.5.0-12.5.0-1+deb12u12.5.0-1+deb12u22.5.0-1+deb12u32.5.0-1+deb12u4
2.5.0-1+deb12u5
expat
Debian:13
 before 2.8.2-1~deb13u1, plus listed versions
2.7.1-22.7.2-12.7.3-12.7.3-22.7.4-1
Show 4 moreShow less
2.7.5-12.8.0-12.8.0-22.8.1-1
2.8.2-1~deb13u1
expat
Debian:14
 before 2.7.2-1, plus listed versions
2.7.1-2
2.7.2-1
firefox-esr
Debian:12
 before 140.9.0esr-1~deb12u1, plus listed versions
102.11.0esr-1102.12.0esr-1102.12.0esr-1~deb10u1102.12.0esr-1~deb11u1102.12.0esr-1~deb12u1
Show 45 moreShow less
102.13.0esr-1102.13.0esr-1~deb10u1102.13.0esr-1~deb11u1102.13.0esr-1~deb12u1102.14.0esr-1~deb10u1102.14.0esr-1~deb11u1102.14.0esr-1~deb12u1102.15.0esr-1~deb10u1102.15.0esr-1~deb11u1102.15.0esr-1~deb12u1102.15.1esr-1~deb10u1102.15.1esr-1~deb11u1102.15.1esr-1~deb12u1115.0.2esr-1115.1.0esr-1115.10.0esr-1115.10.0esr-1~deb10u1115.10.0esr-1~deb11u1115.10.0esr-1~deb12u1115.11.0esr-1115.11.0esr-1~deb10u1115.11.0esr-1~deb11u1115.11.0esr-1~deb12u1115.12.0esr-1115.12.0esr-1~deb10u1115.12.0esr-1~deb11u1115.12.0esr-1~deb12u1115.13.0esr-1115.13.0esr-1~deb11u1115.13.0esr-1~deb12u1115.13.0esr-2115.14.0esr-1115.14.0esr-1~deb11u1115.14.0esr-1~deb12u1115.15.0esr-1115.15.0esr-1~deb11u1115.15.0esr-1~deb12u1115.2.0esr-1115.2.1esr-1115.3.0esr-1115.3.0esr-1~deb10u1115.3.0esr-1~deb11u1115.3.0esr-1~deb12u1115.3.1esr-1~deb10u1115.3.1esr-1~deb11u1
140.9.0esr-1~deb12u1
firefox-esr
Debian:13
 before 140.9.0esr-1~deb13u1, plus listed versions
128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1
Show 33 moreShow less
140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1140.3.1esr-2140.4.0esr-1140.4.0esr-1~deb11u1140.4.0esr-1~deb12u1140.4.0esr-1~deb13u1140.5.0esr-1140.5.0esr-1~deb11u1140.5.0esr-1~deb12u1140.5.0esr-1~deb13u1140.6.0esr-1140.6.0esr-1~deb11u1140.6.0esr-1~deb12u1140.6.0esr-1~deb13u1140.7.0esr-1140.7.0esr-1~deb11u1140.7.0esr-1~deb12u1140.7.0esr-1~deb13u1140.8.0esr-1140.8.0esr-1~deb11u1140.8.0esr-1~deb12u1140.8.0esr-1~deb13u1140.9.0esr-1~deb11u1140.9.0esr-1~deb12u1
140.9.0esr-1~deb13u1
firefox-esr
Debian:14
 before 140.9.0esr-1, plus listed versions
128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1
Show 34 moreShow less
140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1140.3.1esr-2140.4.0esr-1140.4.0esr-1~deb11u1140.4.0esr-1~deb12u1140.4.0esr-1~deb13u1140.5.0esr-1140.5.0esr-1~deb11u1140.5.0esr-1~deb12u1140.5.0esr-1~deb13u1140.6.0esr-1140.6.0esr-1~deb11u1140.6.0esr-1~deb12u1140.6.0esr-1~deb13u1140.7.0esr-1140.7.0esr-1~deb11u1140.7.0esr-1~deb12u1140.7.0esr-1~deb13u1140.8.0esr-1140.8.0esr-1~deb11u1140.8.0esr-1~deb12u1140.8.0esr-1~deb13u1140.9.0esr-1~deb11u1140.9.0esr-1~deb12u1140.9.0esr-1~deb13u1
140.9.0esr-1
thunderbird
Debian:12
 before 1:140.9.0esr-1~deb12u1, plus listed versions
1:102.11.0-11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u1
Show 45 moreShow less
1:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:103.0~b5-11:104.0~b2-11:110.0~b4-11:112.0~b1-11:113.0~b3-11:114.0~b2-11:115.0-11:115.0.1-11:115.0.1-21:115.0~b4-11:115.0~b6-11:115.1.0-11:115.1.1-11:115.10.1-11:115.10.1-1~deb10u11:115.10.1-1~deb11u11:115.10.1-1~deb12u11:115.11.0-11:115.11.0-1~deb10u11:115.11.0-1~deb11u11:115.11.0-1~deb12u11:115.12.0-11:115.12.0-1~deb10u11:115.12.0-1~deb11u11:115.12.0-1~deb12u11:115.13.0-11:115.13.0-1~deb11u11:115.13.0-1~deb12u1
1:140.9.0esr-1~deb12u1
thunderbird
Debian:13
 before 1:140.9.0esr-1~deb13u1, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 42 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.2.0esr-11:140.3.0esr-11:140.3.0esr-1~deb11u11:140.3.0esr-1~deb12u11:140.3.0esr-1~deb13u11:140.3.1esr-11:140.4.0esr-11:140.4.0esr-1~deb11u11:140.4.0esr-1~deb12u11:140.4.0esr-1~deb13u11:140.5.0esr-11:140.5.0esr-1~deb11u11:140.5.0esr-1~deb12u11:140.5.0esr-1~deb13u11:140.6.0esr-11:140.6.0esr-1~deb11u11:140.6.0esr-1~deb12u11:140.6.0esr-1~deb13u11:140.7.0esr-11:140.7.0esr-1~deb11u11:140.7.0esr-1~deb12u11:140.7.0esr-1~deb13u11:140.7.1esr-11:140.7.1esr-1~deb11u11:140.7.1esr-1~deb12u11:140.7.1esr-1~deb13u11:140.8.0esr-11:140.8.0esr-1~deb11u11:140.8.0esr-1~deb12u11:140.8.0esr-1~deb13u11:140.9.0esr-1~deb11u11:140.9.0esr-1~deb12u1
1:140.9.0esr-1~deb13u1
thunderbird
Debian:14
 before 1:140.9.0esr-1, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 43 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.2.0esr-11:140.3.0esr-11:140.3.0esr-1~deb11u11:140.3.0esr-1~deb12u11:140.3.0esr-1~deb13u11:140.3.1esr-11:140.4.0esr-11:140.4.0esr-1~deb11u11:140.4.0esr-1~deb12u11:140.4.0esr-1~deb13u11:140.5.0esr-11:140.5.0esr-1~deb11u11:140.5.0esr-1~deb12u11:140.5.0esr-1~deb13u11:140.6.0esr-11:140.6.0esr-1~deb11u11:140.6.0esr-1~deb12u11:140.6.0esr-1~deb13u11:140.7.0esr-11:140.7.0esr-1~deb11u11:140.7.0esr-1~deb12u11:140.7.0esr-1~deb13u11:140.7.1esr-11:140.7.1esr-1~deb11u11:140.7.1esr-1~deb12u11:140.7.1esr-1~deb13u11:140.8.0esr-11:140.8.0esr-1~deb11u11:140.8.0esr-1~deb12u11:140.8.0esr-1~deb13u11:140.9.0esr-1~deb11u11:140.9.0esr-1~deb12u11:140.9.0esr-1~deb13u1
1:140.9.0esr-1
firefox-esr
Debian:11
From an advisory covering 36 CVEs
 before 140.9.0esr-1~deb11u1, plus listed versions
102.1.0esr-1102.1.0esr-2102.10.0esr-1102.10.0esr-1~deb10u1102.10.0esr-1~deb11u1
Show 45 moreShow less
102.11.0esr-1102.11.0esr-1~deb10u1102.11.0esr-1~deb11u1102.12.0esr-1102.12.0esr-1~deb10u1102.12.0esr-1~deb11u1102.12.0esr-1~deb12u1102.13.0esr-1102.13.0esr-1~deb10u1102.13.0esr-1~deb11u1102.13.0esr-1~deb12u1102.14.0esr-1~deb10u1102.14.0esr-1~deb11u1102.14.0esr-1~deb12u1102.15.0esr-1~deb10u1102.15.0esr-1~deb11u1102.15.0esr-1~deb12u1102.15.1esr-1~deb10u1102.15.1esr-1~deb11u1102.15.1esr-1~deb12u1102.2.0esr-1102.3.0esr-1102.3.0esr-1~deb10u1102.3.0esr-1~deb10u2102.3.0esr-1~deb11u1102.4.0esr-1102.4.0esr-1~deb10u1102.4.0esr-1~deb11u1102.5.0esr-1102.5.0esr-1~deb10u1102.5.0esr-1~deb11u1102.6.0esr-1102.6.0esr-1~deb10u1102.6.0esr-1~deb11u1102.7.0esr-1102.7.0esr-1~deb10u1102.7.0esr-1~deb11u1102.8.0esr-1102.8.0esr-1~deb10u1102.8.0esr-1~deb11u1102.9.0esr-1102.9.0esr-1~deb10u1102.9.0esr-1~deb11u1102.9.0esr-2115.0.2esr-1
140.9.0esr-1~deb11u1
thunderbird
Debian:11
From an advisory covering 38 CVEs
 before 1:140.9.0esr-1~deb11u1, plus listed versions
1:102.0.1-11:102.0.2-11:102.0~b4-11:102.0~b7-11:102.1.0-1
Show 45 moreShow less
1:102.1.1-11:102.1.2-11:102.10.0-11:102.10.0-1~deb10u11:102.10.0-1~deb11u11:102.11.0-11:102.11.0-1~deb10u11:102.11.0-1~deb11u11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u11:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:102.2.0-11:102.2.1-11:102.2.2-11:102.3.0-11:102.3.0-1~deb10u11:102.3.0-1~deb11u11:102.3.1-11:102.3.2-11:102.3.3-11:102.4.0-11:102.4.0-1~deb10u11:102.4.0-1~deb11u11:102.4.1-11:102.5.0-11:102.5.0-1~deb10u11:102.5.0-1~deb11u1
1:140.9.0esr-1~deb11u1
firefox-esr
Debian:12
From an advisory covering 36 CVEs
 before 140.9.0esr-1~deb12u1, plus listed versions
102.11.0esr-1102.12.0esr-1102.12.0esr-1~deb10u1102.12.0esr-1~deb11u1102.12.0esr-1~deb12u1
Show 45 moreShow less
102.13.0esr-1102.13.0esr-1~deb10u1102.13.0esr-1~deb11u1102.13.0esr-1~deb12u1102.14.0esr-1~deb10u1102.14.0esr-1~deb11u1102.14.0esr-1~deb12u1102.15.0esr-1~deb10u1102.15.0esr-1~deb11u1102.15.0esr-1~deb12u1102.15.1esr-1~deb10u1102.15.1esr-1~deb11u1102.15.1esr-1~deb12u1115.0.2esr-1115.1.0esr-1115.10.0esr-1115.10.0esr-1~deb10u1115.10.0esr-1~deb11u1115.10.0esr-1~deb12u1115.11.0esr-1115.11.0esr-1~deb10u1115.11.0esr-1~deb11u1115.11.0esr-1~deb12u1115.12.0esr-1115.12.0esr-1~deb10u1115.12.0esr-1~deb11u1115.12.0esr-1~deb12u1115.13.0esr-1115.13.0esr-1~deb11u1115.13.0esr-1~deb12u1115.13.0esr-2115.14.0esr-1115.14.0esr-1~deb11u1115.14.0esr-1~deb12u1115.15.0esr-1115.15.0esr-1~deb11u1115.15.0esr-1~deb12u1115.2.0esr-1115.2.1esr-1115.3.0esr-1115.3.0esr-1~deb10u1115.3.0esr-1~deb11u1115.3.0esr-1~deb12u1115.3.1esr-1~deb10u1115.3.1esr-1~deb11u1
140.9.0esr-1~deb12u1
firefox-esr
Debian:13
From an advisory covering 36 CVEs
 before 140.9.0esr-1~deb13u1, plus listed versions
128.13.0esr-1128.14.0esr-1128.14.0esr-1~deb11u1128.14.0esr-1~deb12u1128.14.0esr-1~deb13u1
Show 31 moreShow less
140.3.0esr-1140.3.0esr-1~deb11u1140.3.0esr-1~deb11u2140.3.0esr-1~deb12u1140.3.0esr-1~deb13u1140.3.0esr-2140.3.1esr-1140.3.1esr-1~deb11u1140.3.1esr-1~deb12u1140.3.1esr-1~deb13u1140.3.1esr-2140.4.0esr-1140.4.0esr-1~deb11u1140.4.0esr-1~deb12u1140.4.0esr-1~deb13u1140.5.0esr-1140.5.0esr-1~deb11u1140.5.0esr-1~deb12u1140.5.0esr-1~deb13u1140.6.0esr-1140.6.0esr-1~deb11u1140.6.0esr-1~deb12u1140.6.0esr-1~deb13u1140.7.0esr-1140.7.0esr-1~deb11u1140.7.0esr-1~deb12u1140.7.0esr-1~deb13u1140.8.0esr-1140.8.0esr-1~deb11u1140.8.0esr-1~deb12u1140.8.0esr-1~deb13u1
140.9.0esr-1~deb13u1
thunderbird
Debian:12
From an advisory covering 38 CVEs
 before 1:140.9.0esr-1~deb12u1, plus listed versions
1:102.11.0-11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u1
Show 45 moreShow less
1:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:103.0~b5-11:104.0~b2-11:110.0~b4-11:112.0~b1-11:113.0~b3-11:114.0~b2-11:115.0-11:115.0.1-11:115.0.1-21:115.0~b4-11:115.0~b6-11:115.1.0-11:115.1.1-11:115.10.1-11:115.10.1-1~deb10u11:115.10.1-1~deb11u11:115.10.1-1~deb12u11:115.11.0-11:115.11.0-1~deb10u11:115.11.0-1~deb11u11:115.11.0-1~deb12u11:115.12.0-11:115.12.0-1~deb10u11:115.12.0-1~deb11u11:115.12.0-1~deb12u11:115.13.0-11:115.13.0-1~deb11u11:115.13.0-1~deb12u1
1:140.9.0esr-1~deb12u1
thunderbird
Debian:13
From an advisory covering 38 CVEs
 before 1:140.9.0esr-1~deb13u1, plus listed versions
1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1
Show 41 moreShow less
1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.2.0esr-11:140.3.0esr-11:140.3.0esr-1~deb11u11:140.3.0esr-1~deb12u11:140.3.0esr-1~deb13u11:140.3.1esr-11:140.4.0esr-11:140.4.0esr-1~deb11u11:140.4.0esr-1~deb12u11:140.4.0esr-1~deb13u11:140.5.0esr-11:140.5.0esr-1~deb11u11:140.5.0esr-1~deb12u11:140.5.0esr-1~deb13u11:140.6.0esr-11:140.6.0esr-1~deb11u11:140.6.0esr-1~deb12u11:140.6.0esr-1~deb13u11:140.7.0esr-11:140.7.0esr-1~deb11u11:140.7.0esr-1~deb12u11:140.7.0esr-1~deb13u11:140.7.1esr-11:140.7.1esr-1~deb11u11:140.7.1esr-1~deb12u11:140.7.1esr-1~deb13u11:140.8.0esr-11:140.8.0esr-1~deb11u11:140.8.0esr-1~deb12u11:140.8.0esr-1~deb13u11:140.9.0esr-1~deb11u1
1:140.9.0esr-1~deb13u1
Expat_jll
Julia
 before 2.7.3+0
2.7.3+0
expat
Mageia:9
From an advisory covering 2 CVEs
 before 2.7.3-1.mga9
2.7.3-1.mga9
nss
Mageia:9
From an advisory covering 38 CVEs
 before 3.122.0-1.mga9
3.122.0-1.mga9
firefox
Mageia:9
From an advisory covering 38 CVEs
 before 140.9.0-1.mga9
140.9.0-1.mga9
firefox-l10n
Mageia:9
From an advisory covering 38 CVEs
 before 140.9.0-1.mga9
140.9.0-1.mga9
thunderbird
Mageia:9
From an advisory covering 39 CVEs
 before 140.9.0-1.mga9
140.9.0-1.mga9
thunderbird-l10n
Mageia:9
From an advisory covering 39 CVEs
 before 140.9.0-1.mga9
140.9.0-1.mga9
expat
openEuler:20.03-LTS-SP4
 before 2.2.9-17.oe2003sp4
2.2.9-17.oe2003sp4
expat
openEuler:22.03-LTS-SP3
 before 2.4.1-18.oe2203sp3
2.4.1-18.oe2203sp3
expat
openEuler:22.03-LTS-SP4
 before 2.4.1-18.oe2203sp4
2.4.1-18.oe2203sp4
expat
openEuler:24.03-LTS
 before 2.5.0-10.oe2403
2.5.0-10.oe2403
expat
openEuler:24.03-LTS-SP1
 before 2.5.0-11.oe2403sp1
2.5.0-11.oe2403sp1
expat
openEuler:24.03-LTS-SP2
 before 2.5.0-10.oe2403sp2
2.5.0-10.oe2403sp2
firefox
openEuler:24.03-LTS
From an advisory covering 38 CVEs
 before 140.9.0-1.oe2403
140.9.0-1.oe2403
firefox
openEuler:24.03-LTS-SP1
From an advisory covering 38 CVEs
 before 140.9.0-1.oe2403sp1
140.9.0-1.oe2403sp1
firefox
openEuler:24.03-LTS-SP2
From an advisory covering 38 CVEs
 before 140.9.0-1.oe2403sp2
140.9.0-1.oe2403sp2
firefox
openEuler:24.03-LTS-SP3
From an advisory covering 38 CVEs
 before 140.9.0-1.oe2403sp3
140.9.0-1.oe2403sp3
firefox
openEuler:22.03-LTS-SP4
From an advisory covering 38 CVEs
 before 140.9.0-1.oe2203sp4
140.9.0-1.oe2203sp4
thunderbird
openEuler:24.03-LTS-SP2
From an advisory covering 40 CVEs
 before 140.9.1-1.oe2403sp2
140.9.1-1.oe2403sp2
thunderbird
openEuler:24.03-LTS-SP3
From an advisory covering 40 CVEs
 before 140.9.1-1.oe2403sp3
140.9.1-1.oe2403sp3
expat-debuginfo
Red Hat:enterprise_linux:10.0
 before 0:2.7.1-1.el10_0.3
0:2.7.1-1.el10_0.3
expat-debugsource
Red Hat:enterprise_linux:10.0
 before 0:2.7.1-1.el10_0.3
0:2.7.1-1.el10_0.3
expat-devel
Red Hat:enterprise_linux:10.0
 before 0:2.7.1-1.el10_0.3
0:2.7.1-1.el10_0.3
expat
Red Hat:enterprise_linux:10.0
 before 0:2.7.1-1.el10_0.3
0:2.7.1-1.el10_0.3
expat-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:2.7.1-1.el10_1.3
0:2.7.1-1.el10_1.3
expat-debugsource
Red Hat:enterprise_linux:10.1
 before 0:2.7.1-1.el10_1.3
0:2.7.1-1.el10_1.3
expat-devel
Red Hat:enterprise_linux:10.1
 before 0:2.7.1-1.el10_1.3
0:2.7.1-1.el10_1.3
expat
Red Hat:enterprise_linux:10.1
 before 0:2.7.1-1.el10_1.3
0:2.7.1-1.el10_1.3
expat-debuginfo
Red Hat:rhel_eus:9.6::appstream
 before 0:2.5.0-5.el9_6.1
0:2.5.0-5.el9_6.1
expat-debugsource
Red Hat:rhel_eus:9.6::appstream
 before 0:2.5.0-5.el9_6.1
0:2.5.0-5.el9_6.1
expat-devel
Red Hat:rhel_eus:9.6::appstream
 before 0:2.5.0-5.el9_6.1
0:2.5.0-5.el9_6.1
expat
Red Hat:rhel_eus:9.6::baseos
 before 0:2.5.0-5.el9_6.1
0:2.5.0-5.el9_6.1
expat-debuginfo
Red Hat:rhel_eus:9.6::baseos
 before 0:2.5.0-5.el9_6.1
0:2.5.0-5.el9_6.1
expat-debugsource
Red Hat:rhel_eus:9.6::baseos
 before 0:2.5.0-5.el9_6.1
0:2.5.0-5.el9_6.1
expat
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
expat-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
expat-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
expat-devel
Red Hat:enterprise_linux:8::baseos
From an advisory covering 4 CVEs
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
mingw-expat
Red Hat:enterprise_linux:8::crb
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
mingw32-expat
Red Hat:enterprise_linux:8::crb
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
mingw32-expat-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
mingw64-expat
Red Hat:enterprise_linux:8::crb
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
mingw64-expat-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
expat
Red Hat:rhel_eus:9.4::baseos
From an advisory covering 2 CVEs
 before 0:2.5.0-2.el9_4.3
0:2.5.0-2.el9_4.3
expat
Red Hat:rhel_e4s:9.2::baseos
From an advisory covering 2 CVEs
 before 0:2.5.0-1.el9_2.3
0:2.5.0-1.el9_2.3
expat
Red Hat:rhel_e4s:9.0::baseos
From an advisory covering 4 CVEs
 before 0:2.2.10-12.el9_0.4
0:2.2.10-12.el9_0.4
expat-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:2.5.0-5.el9_7.1
0:2.5.0-5.el9_7.1
expat-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:2.5.0-5.el9_7.1
0:2.5.0-5.el9_7.1
expat-devel
Red Hat:enterprise_linux:9::appstream
 before 0:2.5.0-5.el9_7.1
0:2.5.0-5.el9_7.1
expat
Red Hat:enterprise_linux:9::baseos
 before 0:2.5.0-5.el9_7.1
0:2.5.0-5.el9_7.1
expat-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:2.5.0-5.el9_7.1
0:2.5.0-5.el9_7.1
expat-debugsource
Red Hat:enterprise_linux:9::baseos
 before 0:2.5.0-5.el9_7.1
0:2.5.0-5.el9_7.1
expat
Red Hat:rhel_e4s:8.8::baseos
From an advisory covering 4 CVEs
 before 0:2.2.10-1.el8_8
0:2.2.10-1.el8_8
expat
Red Hat:rhel_tus:8.8::baseos
From an advisory covering 4 CVEs
 before 0:2.2.10-1.el8_8
0:2.2.10-1.el8_8
expat
Red Hat:rhel_aus:8.4::baseos
From an advisory covering 16 CVEs
 before 0:2.2.10-1.el8_4
0:2.2.10-1.el8_4
expat
Red Hat:rhel_eus_long_life:8.4::baseos
From an advisory covering 16 CVEs
 before 0:2.2.10-1.el8_4
0:2.2.10-1.el8_4
expat
Red Hat:rhel_aus:8.6::baseos
From an advisory covering 4 CVEs
 before 0:2.2.10-1.el8_6
0:2.2.10-1.el8_6
expat
Red Hat:rhel_e4s:8.6::baseos
From an advisory covering 4 CVEs
 before 0:2.2.10-1.el8_6
0:2.2.10-1.el8_6
expat
Red Hat:rhel_tus:8.6::baseos
From an advisory covering 4 CVEs
 before 0:2.2.10-1.el8_6
0:2.2.10-1.el8_6
expat
Red Hat:rhel_aus:8.2::baseos
From an advisory covering 18 CVEs
 before 0:2.2.10-1.el8_2
0:2.2.10-1.el8_2
spice-client-win
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_8.1
0:8.10-3.el8_8.1
spice-client-win-x64
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_8.1
0:8.10-3.el8_8.1
spice-client-win-x86
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_8.1
0:8.10-3.el8_8.1
spice-client-win
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_8.1
0:8.10-3.el8_8.1
spice-client-win-x64
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_8.1
0:8.10-3.el8_8.1
spice-client-win-x86
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_8.1
0:8.10-3.el8_8.1
spice-client-win
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_6.1
0:8.10-3.el8_6.1
spice-client-win-x64
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_6.1
0:8.10-3.el8_6.1
spice-client-win-x86
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_6.1
0:8.10-3.el8_6.1
spice-client-win
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_6.1
0:8.10-3.el8_6.1
spice-client-win-x64
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_6.1
0:8.10-3.el8_6.1
spice-client-win-x86
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_6.1
0:8.10-3.el8_6.1
spice-client-win
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_6.1
0:8.10-3.el8_6.1
spice-client-win-x64
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_6.1
0:8.10-3.el8_6.1
spice-client-win-x86
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_6.1
0:8.10-3.el8_6.1
spice-client-win
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_4.1
0:8.10-3.el8_4.1
spice-client-win-x64
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_4.1
0:8.10-3.el8_4.1
spice-client-win-x86
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_4.1
0:8.10-3.el8_4.1
spice-client-win
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_4.1
0:8.10-3.el8_4.1
spice-client-win-x64
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_4.1
0:8.10-3.el8_4.1
spice-client-win-x86
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 4 CVEs
 before 0:8.10-3.el8_4.1
0:8.10-3.el8_4.1
expat
Rocky Linux:10
 before 0:2.7.1-1.el10_0.3
0:2.7.1-1.el10_0.3
expat
Rocky Linux:8
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
mingw-expat
Rocky Linux:8
 before 0:2.5.0-1.el8_10
0:2.5.0-1.el8_10
expat
Rocky Linux:9
 before 0:2.5.0-5.el9_7.1
0:2.5.0-5.el9_7.1
python3.12
Rocky Linux:8
From an advisory covering 11 CVEs
 before 0:3.12.13-2.el8_10
0:3.12.13-2.el8_10
python3.12
Rocky Linux:10
From an advisory covering 12 CVEs
 before 0:3.12.13-2.el10_2
0:3.12.13-2.el10_2
python3.12
Rocky Linux:9
From an advisory covering 12 CVEs
 before 0:3.12.13-2.el9_8
0:3.12.13-2.el9_8
mingw-fontconfig
Rocky Linux:8
 before 0:2.12.6-4.el8_10
0:2.12.6-4.el8_10
expat
Root:Debian:11
 before 2.2.10-2+deb11u7.aikido.20
2.2.10-2+deb11u7.aikido.20
rootio-expat
Root:Debian:11
 before 2.2.10-2+deb11u7.aikido.20
2.2.10-2+deb11u7.aikido.20
expat
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 2.7.1-150700.3.6.1
2.7.1-150700.3.6.1
expat
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 2.7.1-21.46.1
2.7.1-21.46.1
expat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 2.7.1-21.46.1
2.7.1-21.46.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 2.7.1-150000.3.39.1
2.7.1-150000.3.39.1
expat
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 2.7.1-150000.3.39.1
2.7.1-150000.3.39.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 2.7.1-150000.3.39.1
2.7.1-150000.3.39.1
expat
SUSE:Linux Enterprise Micro 5.1
 before 2.7.1-150000.3.39.1
2.7.1-150000.3.39.1
expat
SUSE:Linux Enterprise Micro 5.2
 before 2.7.1-150000.3.39.1
2.7.1-150000.3.39.1
expat
SUSE:Enterprise Storage 7.1
 before 2.7.1-150000.3.39.1
2.7.1-150000.3.39.1
expat
SUSE:Linux Enterprise Micro 5.3
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Linux Enterprise Micro 5.4
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Linux Enterprise Micro 5.5
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Linux Enterprise Module for Basesystem 15 SP6
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Manager Proxy LTS 4.3
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Manager Server LTS 4.3
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
openSUSE:Leap 15.6
 before 2.7.1-150400.3.31.1
2.7.1-150400.3.31.1
expat
SUSE:Linux Micro 6.0
 before 2.7.1-3.1
2.7.1-3.1
expat
SUSE:Linux Micro 6.1
 before 2.7.1-slfo.1.1_3.1
2.7.1-slfo.1.1_3.1
expat
SUSE:Linux Enterprise Server 16.0
 before 2.7.1-160000.3.1
2.7.1-160000.3.1
expat
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 2.7.1-160000.3.1
2.7.1-160000.3.1
expat
SUSE:Linux Micro 6.2
 before 2.7.1-160000.3.1
2.7.1-160000.3.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
From an advisory covering 38 CVEs
 before 140.9.0-150200.152.225.1
140.9.0-150200.152.225.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 38 CVEs
 before 140.9.0-150200.152.225.1
140.9.0-150200.152.225.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 38 CVEs
 before 140.9.0-150200.152.225.1
140.9.0-150200.152.225.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 38 CVEs
 before 140.9.0-150200.152.225.1
140.9.0-150200.152.225.1
MozillaFirefox
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 38 CVEs
 before 140.9.0-150200.152.225.1
140.9.0-150200.152.225.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 38 CVEs
 before 140.9.0-150200.152.225.1
140.9.0-150200.152.225.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 38 CVEs
 before 140.9.0-150200.152.225.1
140.9.0-150200.152.225.1
MozillaFirefox
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 38 CVEs
 before 140.9.0-150200.152.225.1
140.9.0-150200.152.225.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 38 CVEs
 before 140.9.0-150200.152.225.1
140.9.0-150200.152.225.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 38 CVEs
 before 140.9.0-150200.152.225.1
140.9.0-150200.152.225.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 38 CVEs
 before 140.9.0-150200.152.225.1
140.9.0-150200.152.225.1
MozillaFirefox
openSUSE:Leap 15.6
From an advisory covering 38 CVEs
 before 140.9.0-150200.152.225.1
140.9.0-150200.152.225.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 38 CVEs
 before 140.9.0-112.304.2
140.9.0-112.304.2
MozillaFirefox
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 38 CVEs
 before 140.9.0-112.304.2
140.9.0-112.304.2
MozillaThunderbird
openSUSE:Leap 15.6
From an advisory covering 40 CVEs
 before 140.9.0-150200.8.263.1
140.9.0-150200.8.263.1
MozillaFirefox
SUSE:Linux Enterprise Server 16.0
From an advisory covering 38 CVEs
 before 140.9.0-160000.1.1
140.9.0-160000.1.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 38 CVEs
 before 140.9.0-160000.1.1
140.9.0-160000.1.1
expat
SUSE:Linux Micro 6.0
From an advisory covering 34 CVEs
 before 2.8.5-159998.1.1
2.8.5-159998.1.1
expat
SUSE:Linux Micro 6.1
From an advisory covering 29 CVEs
 before 2.8.5-slfo.1.1_1.1
2.8.5-slfo.1.1_1.1
expat
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-21.55.1
2.8.5-21.55.1
expat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 34 CVEs
 before 2.8.5-21.55.1
2.8.5-21.55.1
expat
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 29 CVEs
 before 2.8.5-150700.3.15.1
2.8.5-150700.3.15.1
expat
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 34 CVEs
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
coin3
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50-33.1.4~abc9f50-43.1.4~abc9f50-4ubuntu23.1.4~abc9f50-4ubuntu2+esm13.1.4~abc9f50-4ubuntu2+esm2
 None known
expat
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.12.1.0-4ubuntu1.22.1.0-4ubuntu1.3
Show 12 moreShow less
2.1.0-4ubuntu1.42.1.0-4ubuntu1.4+esm12.1.0-4ubuntu1.4+esm22.1.0-4ubuntu1.4+esm42.1.0-4ubuntu1.4+esm62.1.0-4ubuntu1.4+esm72.1.0-4ubuntu1.4+esm82.1.0-4ubuntu1.4+esm92.1.0-4ubuntu1.4+esm102.1.0-4ubuntu1.4+esm112.1.0-4ubuntu1.4+esm122.1.0-4ubuntu1.4+esm13
 None known
vnc4
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37ubuntu54.1.1+xorg4.3.0-37ubuntu5.0.14.1.1+xorg4.3.0-37ubuntu5.0.24.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
 None known
vtk
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
5.8.0-14ubuntu15.8.0-14ubuntu35.8.0-14.1ubuntu25.8.0-14.1ubuntu35.8.0-14.1ubuntu3+esm1
 None known
xmlrpc-c
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.16.33-3.2ubuntu31.33.06-0ubuntu11.33.06-0ubuntu1+esm1
 None known
expat
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.1.0-72.1.0-7ubuntu0.16.04.12.1.0-7ubuntu0.16.04.22.1.0-7ubuntu0.16.04.32.1.0-7ubuntu0.16.04.4
Show 12 moreShow less
2.1.0-7ubuntu0.16.04.52.1.0-7ubuntu0.16.04.5+esm22.1.0-7ubuntu0.16.04.5+esm52.1.0-7ubuntu0.16.04.5+esm62.1.0-7ubuntu0.16.04.5+esm72.1.0-7ubuntu0.16.04.5+esm82.1.0-7ubuntu0.16.04.5+esm92.1.0-7ubuntu0.16.04.5+esm102.1.0-7ubuntu0.16.04.5+esm112.1.0-7ubuntu0.16.04.5+esm122.1.0-7ubuntu0.16.04.5+esm132.1.0-7ubuntu0.16.04.5+esm14
 None known
ayttm
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.6.3-3build10.6.3-3ubuntu0.1~esm1
 None known
cableswig
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.1.0+git20150808-10.1.0+git20150808-20.1.0+git20150808-2ubuntu0.1~esm1
 None known
cadaver
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.23.3-2ubuntu2
 None known
coin3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
 None known
gdcm
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.4.4-42.4.4-4build12.4.4-4ubuntu12.6.1-32.6.2-1
Show 7 moreShow less
2.6.2-22.6.2-32.6.3-12.6.3-1ubuntu12.6.3-2ubuntu12.6.3-3ubuntu12.6.3-3ubuntu3
 None known
insighttoolkit4
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.8.1-1ubuntu34.8.1-1ubuntu44.8.2-3.1ubuntu14.9.0-3ubuntu24.9.0-4ubuntu14.9.0-4ubuntu1.1
 None known
libxmltok
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.2-3build31.2-3ubuntu0.1~esm11.2-3ubuntu0.16.04.1~esm11.2-3ubuntu0.16.04.1~esm21.2-3ubuntu0.16.04.1~esm31.2-3ubuntu0.16.04.1~esm41.2-3ubuntu0.16.04.1~esm5
 None known
matanza
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.13+ds1-5
 None known
smart
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.4-2
 None known
swish-e
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.4.7-42.4.7-4build12.4.7-4ubuntu0.1~esm1
 None known
tdom
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.8.3-1
 None known
vnc4
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu24.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
 None known
vtk
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.10.1+dfsg-25.10.1+dfsg-2build35.10.1+dfsg-2.1build15.10.1+dfsg-2.1ubuntu0.1~esm1
 None known
wbxml2
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.10.7-1
 None known
xmlrpc-c
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.33.14-0.2ubuntu31.33.14-1ubuntu11.33.14-1ubuntu1+esm1
 None known
expat
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.3-12.2.3-22.2.5-0ubuntu22.2.5-32.2.5-3ubuntu0.1
Show 10 moreShow less
2.2.5-3ubuntu0.22.2.5-3ubuntu0.42.2.5-3ubuntu0.72.2.5-3ubuntu0.82.2.5-3ubuntu0.92.2.5-3ubuntu0.9+esm12.2.5-3ubuntu0.9+esm22.2.5-3ubuntu0.9+esm32.2.5-3ubuntu0.9+esm42.2.5-3ubuntu0.9+esm5
 None known
cadaver
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.23.3-2ubuntu3
 None known
coin3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-23.1.4~abc9f50+dfsg2-13.1.4~abc9f50+dfsg3-13.1.4~abc9f50+dfsg3-23.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
 None known
gdcm
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.8.2-3build12.8.3-12.8.4-12.8.4-1build2
 None known
insighttoolkit4
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.12.2-dfsg1-1ubuntu1
 None known
libxmltok
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.2-41.2-4ubuntu0.18.04.1~esm11.2-4ubuntu0.18.04.1~esm21.2-4ubuntu0.18.04.1~esm31.2-4ubuntu0.18.04.1~esm41.2-4ubuntu0.18.04.1~esm51.2-4ubuntu0.18.04.1~esm61.2-4ubuntu0.18.04.1~esm7
 None known
matanza
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.13+ds1-5build10.13+ds1-6
 None known
smart
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.4-2
 None known
swish-e
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.4.7-5ubuntu12.4.7-5ubuntu1+esm1
 None known
tdom
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.8.3-10.9.0-1
 None known
vnc4
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu2
 None known
wbxml2
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.10.7-10.10.7-1build1
 None known
xmlrpc-c
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.33.14-71.33.14-81.33.14-8build11.33.14-8ubuntu0.18.04.1~esm1
 None known
expat
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.2.7-22.2.9-12.2.9-1build12.2.9-1ubuntu0.22.2.9-1ubuntu0.4
Show 7 moreShow less
2.2.9-1ubuntu0.52.2.9-1ubuntu0.62.2.9-1ubuntu0.72.2.9-1ubuntu0.82.2.9-1ubuntu0.8+esm12.2.9-1ubuntu0.8+esm22.2.9-1ubuntu0.8+esm3
 None known
cadaver
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.23.3-2.1build1
 None known
insighttoolkit4
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.12.2-dfsg1-4.1ubuntu14.13.2-dfsg1-1ubuntu14.13.2-dfsg1-4ubuntu14.13.2-dfsg1-64.13.2-dfsg1-6ubuntu14.13.2-dfsg1-8
 None known
libxmltok
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.2-41.2-4ubuntu0.20.04.1~esm11.2-4ubuntu0.20.04.1~esm21.2-4ubuntu0.20.04.1~esm31.2-4ubuntu0.20.04.1~esm41.2-4ubuntu0.20.04.1~esm51.2-4ubuntu0.20.04.1~esm61.2-4ubuntu0.20.04.1~esm7
 None known
matanza
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.13+ds1-60.13+ds2-1
 None known
swish-e
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.4.7-6build12.4.7-6build22.4.7-6ubuntu0.1~esm1
 None known
tdom
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.9.1-1
 None known
wbxml2
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.10.7-1build1
 None known
xmlrpc-c
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.33.14-8build11.33.14-8build21.33.14-8ubuntu0.20.04.1~esm1
 None known
cadaver
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.23.3-2.1build1
 None known
expat
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.4.1-22.4.1-32.4.2-12.4.3-12.4.3-2
Show 12 moreShow less
2.4.4-12.4.6-12.4.7-12.4.7-1ubuntu0.12.4.7-1ubuntu0.22.4.7-1ubuntu0.32.4.7-1ubuntu0.42.4.7-1ubuntu0.52.4.7-1ubuntu0.62.4.7-1ubuntu0.72.4.7-1ubuntu0.82.4.7-1ubuntu0.9
 None known
insighttoolkit4
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.13.3withdata-dfsg1-4.14.13.3withdata-dfsg2-1ubuntu1
 None known
matanza
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.13+ds2-1
 None known
tdom
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.9.2-1
 None known
wbxml2
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.10.7-1build10.11.7+dfsg-1
 None known
libxmltok
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.2-41.2-4ubuntu0.22.04.1~esm11.2-4ubuntu0.22.04.1~esm21.2-4ubuntu0.22.04.1~esm31.2-4ubuntu0.22.04.1~esm41.2-4ubuntu0.22.04.1~esm51.2-4ubuntu0.22.04.1~esm61.2-4ubuntu0.22.04.1~esm7
 None known
swish-e
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.4.7-6build32.4.7-6.12.4.7-6.1build12.4.7-6.1ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.33.14-91.33.14-101.33.14-10ubuntu0.1~esm1
 None known
cadaver
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.24+dfsg-20.24+dfsg-30.24+dfsg-3build10.24+dfsg-3build2
 None known
expat
Ubuntu:24.04:LTS
 before 2.6.1-2ubuntu0.5, plus listed versions
2.5.0-22.6.0-12.6.1-22.6.1-2build12.6.1-2ubuntu0.12.6.1-2ubuntu0.22.6.1-2ubuntu0.32.6.1-2ubuntu0.4
2.6.1-2ubuntu0.5
matanza
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.13+ds2-10.13+ds2-1build10.13+ds2-1build2
 None known
tdom
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.9.3-10.9.3-1build1
 None known
wbxml2
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.11.8+dfsg-30.11.8+dfsg-3build1
 None known
libxmltok
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.2-4ubuntu11.2-4.1ubuntu11.2-4.1ubuntu21.2-4.1ubuntu2.24.0.4.1+esm11.2-4.1ubuntu2.24.0.4.1+esm21.2-4.1ubuntu2.24.0.4.1+esm31.2-4.1ubuntu2.24.0.4.1+esm41.2-4.1ubuntu2.24.0.4.1+esm5
 None known
swish-e
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.4.7-6.22.4.7-6.2build12.4.7-6.2build22.4.7-6.2build32.4.7-6.2ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.33.14-111.33.14-11.11.33.14-121.33.14-12build11.33.14-12build21.33.14-12ubuntu0.1~esm1
 None known
expat
openSUSE:Tumbleweed
 before 2.7.2-1.1
2.7.2-1.1
expat
openSUSE:Leap 16.0
 before 2.7.1-160000.3.1
2.7.1-160000.3.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 38 CVEs
 before 140.9.0-1.1
140.9.0-1.1
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 40 CVEs
 before 140.9.0-1.1
140.9.0-1.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 46 CVEs
 before 149.0-1.1
149.0-1.1
MozillaFirefox
openSUSE:Leap 16.0
From an advisory covering 38 CVEs
 before 140.9.0-160000.1.1
140.9.0-160000.1.1

History

History
RecordedChangedSources
affected, aliases, aliases_more, referencesOSV
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-59375 is a high vulnerability (CVSS 7.5) in Libexpat Project Libexpat, published September 15, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in expat 2.7.2-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 80 package rows, 966 versions, 323 references and the rest of 7 source descriptions. The JSON record has them. Also not on the record: 2 aliases. ID and package lookups still check them. Left out on purpose, here and in the API, to keep responses small: 51 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open