Every CVE Search/ Get API key

CVE-2022-22827

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

8.8 HighFix available

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.18%Up 2.3 points since Feb 8, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Record
CVE-2022-22827
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-190
Updated
2026-11-02
CVE List 8.8

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Record
CVE-2022-22827
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2022-27965 8.8

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Record
EUVD-2022-27965
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-97f8-83vc-c97q 8.8

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Record
GHSA-97f8-83vc-c97q
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-190
Updated
2026-11-02
OSVALPINE-CVE-2022-22827 8.8

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Record
ALPINE-CVE-2022-22827
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVAZL-7161 8.8

CVE-2022-22827 affecting package expat for versions less than 2.4.3-1

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Record
AZL-7161
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 32 moreShow less
OSVBELL-CVE-2022-22827 8.8

CVE-2022-22827 does not affect BellSoft software

Record
BELL-CVE-2022-22827
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.8

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Record
CVE-2022-22827
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2022-22827 8.8

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Record
DEBIAN-CVE-2022-22827
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVJLSEC-2025-49 8.8

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Record
JLSEC-2025-49
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
OSVOESA-2022-1490 9.8

expat security update

An XML parser library.

Security Fix(es):

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).(CVE-2021-45960)

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22825)

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22827)

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22822)

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22826)

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22823)

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22824)

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.(CVE-2021-46143)

Record
OESA-2022-1490
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2023-1464 8.8

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).(CVE-2021-45960)

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.(CVE-2021-46143)

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22825)

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22826)

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22827)

Record
OESA-2023-1464
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2023-1465 8.8

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).(CVE-2021-45960)

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.(CVE-2021-46143)

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22825)

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22826)

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22827)

Record
OESA-2023-1465
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHBA-2022:4046 9.8

Red Hat Bug Fix Advisory: new packages: expat

Record
RHBA-2022:4046
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:0951 9.8

Red Hat Security Advisory: expat security update

Record
RHSA-2022:0951
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:1069 9.8

Red Hat Security Advisory: expat security update

Record
RHSA-2022:1069
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2022:7692 9.8

Red Hat Security Advisory: xmlrpc-c security update

Record
RHSA-2022:7692
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22785 9.8

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22785
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2025:22871 9.8

Red Hat Security Advisory: expat security update

Record
RHSA-2025:22871
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:0951 9.8

Important: expat security update

Expat is a C library for parsing XML documents.

Security Fix(es):

  • expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)

  • expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)

  • expat: Integer overflow in storeRawNames() (CVE-2022-25315)

  • expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)

  • expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)

  • expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)

  • expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)

  • expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)

  • expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)

  • expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)

  • expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)

  • expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2022:0951
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2022:7692 9.8

Moderate: xmlrpc-c security update

XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to a remote server using HTTP, and gets back the response in XML.

Security Fix(es):

  • expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)

  • expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)

  • expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)

  • expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)

  • expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)

  • expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)

  • expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

Record
RLSA-2022:7692
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-22827 8.8

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Record
UBUNTU-CVE-2022-22827
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2022:0951 No score

Important: expat security update

Expat is a C library for parsing XML documents. Security Fix(es):

  • expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)
  • expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)
  • expat: Integer overflow in storeRawNames() (CVE-2022-25315)
  • expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)
  • expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)
  • expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)
  • expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)
  • expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)
  • expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)
  • expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)
  • expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)
  • expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Record
ALSA-2022:0951
Updated
2026-11-02
OSVALSA-2022:7692 No score

Moderate: xmlrpc-c security update

XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to a remote server using HTTP, and gets back the response in XML.

Security Fix(es):

  • expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)
  • expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)
  • expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)
  • expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)
  • expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)
  • expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)
  • expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:7692
Updated
2026-11-02
OSVCLSA-2022-1660757175 No score

Fixed 15 CVEs in expat

  • CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
  • CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
  • CVE-2022-25315: Fix integer overflow in storeRawNames()
  • CVE-2022-22822: Fix integer overflow in addBinding()
  • CVE-2022-22823: Fix integer overflow in build_model()
  • CVE-2022-22824: Fix integer overflow in defineAttribute()
  • CVE-2022-22825: Fix integer overflow in lookup()
  • CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
  • CVE-2022-22827: Fix integer overflow in storeAtts()
  • CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
  • CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
  • CVE-2021-45960: Fix troublesome left shifts in storeAtts()
  • CVE-2022-23990: Fix integer overflow in doProlog()
  • CVE-2022-25313: Fix stack exhaustion in build_model()
  • CVE-2022-25314: Fix integer overflow in copyString()
Record
CLSA-2022-1660757175
Updated
2026-11-02
OSVCLSA-2022-1660758476 No score

Fixed 15 CVEs in expat

  • CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
  • CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
  • CVE-2022-25315: Fix integer overflow in storeRawNames()
  • CVE-2022-22822: Fix integer overflow in addBinding()
  • CVE-2022-22823: Fix integer overflow in build_model()
  • CVE-2022-22824: Fix integer overflow in defineAttribute()
  • CVE-2022-22825: Fix integer overflow in lookup()
  • CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
  • CVE-2022-22827: Fix integer overflow in storeAtts()
  • CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
  • CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
  • CVE-2021-45960: Fix troublesome left shifts in storeAtts()
  • CVE-2022-23990: Fix integer overflow in doProlog()
  • CVE-2022-25313: Fix stack exhaustion in build_model()
  • CVE-2022-25314: Fix integer overflow in copyString()
Record
CLSA-2022-1660758476
Updated
2026-11-02
OSVCLSA-2022-1660759632 No score

Fixed 13 CVEs in expat

  • CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
  • CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
  • CVE-2022-25315: Fix integer overflow in storeRawNames()
  • CVE-2022-22822: Fix integer overflow in addBinding()
  • CVE-2022-22823: Fix integer overflow in build_model()
  • CVE-2022-22824: Fix integer overflow in defineAttribute()
  • CVE-2022-22825: Fix integer overflow in lookup()
  • CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
  • CVE-2022-22827: Fix integer overflow in storeAtts()
  • CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
  • CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
  • CVE-2021-45960: Fix troublesome left shifts in storeAtts()
  • CVE-2022-23990: Fix integer overflow in doProlog()
Record
CLSA-2022-1660759632
Updated
2026-11-02
OSVCLSA-2022-1660760528 No score

Fix CVE(s): CVE-2022-25235, CVE-2022-23990, CVE-2022-22825, CVE-2022-22824, CVE-2022-23852, CVE-2022-25315, CVE-2022-25236, CVE-2021-46143, CVE-2022-25313, CVE-2021-45960, CVE-2022-22826, CVE-2022-22827, CVE-2022-22822, CVE-2022-22823

  • SECURITY UPDATE: Stack exhaustion
    • debian/patches/CVE-2022-25313.patch: prevent stack exhaustion in build_model in expat/lib/xmlparse.c.
    • debian/patches/fix-build_model-regression.patch: fix build_model regression in expat/lib/xmlparse.c.
    • CVE-2022-25313
  • SECURITY UPDATE: Integer overflow
    • debian/patches/CVE-2022-25315.patch: prevent integer overflow in storeRawNames in expat/lib/xmlparse.c.
    • CVE-2022-25315
  • SECURITY UPDATE: relax fix to CVE-2022-25236 with regard to RFC 3986 URI characters and possibly regressions
    • debian/patches/CVE-2022-25236-3.patch: add a note on namespace URI validation in expat/doc/reference.html, expat/lib/expat.h.
    • debian/patches/CVE-2022-25236-4.patch: document namespace separator effect right in header expat/lib/expat.h.
    • debian/patches/CVE-2022-25236-5.patch: cover relaxed fix in tests.
    • debian/patches/CVE-2022-25236-6.patch: relax fix with regard to RFC 3986 URI characters in expat/lib/xmlparse.c. (LP: #1963903)
  • fix tests adding XCS definition
    • debian/patches/fix_test_xcs.patch: in tests/runtests.c.
  • SECURITY UPDATE: Realloc misbehavior
    • debian/patches/CVE-2021-45960.patch: detect and prevent troublesome left shifts in function storeAtts in lib/xmlparse.c.
    • CVE-2021-45960
  • SECURITY UPDATE: Integer overflow
    • debian/patches/CVE-2021-46143.patch: prevent integer overflow on m_groupSize in function doProlog in lib/xmlparse.c.
    • CVE-2021-46143
  • SECURITY UPDATE: Integer overflow
    • debian/patches/CVE-2022-22822-to-CVE-2022-22827.patch: prevent integer overflow in multiple places in lib/xmlparse.c.
    • CVE-2022-22822
    • CVE-2022-22823
    • CVE-2022-22824
    • CVE-2022-22825
    • CVE-2022-22826
    • CVE-2022-22827
  • SECURITY UPDATE: Signed integer overflow
    • debian/patches/CVE-2022-23852-*.patch: detect and prevent integer overflow in XML_GetBuffer in expat/lib/xmlparse.c and adds test to cover it in tests/runtests.c.
    • CVE-2022-23852
  • SECURITY UPDATE: Integer overflow
    • debian/patches/CVE-2022-23990.patch: prevent integer overflow in doProlog in lib/xmlparse.c.
    • CVE-2022-23990
  • SECURITY UPDATE: Incomplete validation encoding
    • debian/patches/CVE-2022-25235-*.patch: adds missing validation and adds tests in expat/lib/xmltok_impl.c, expat/tests/runtests.c.
    • CVE-2022-25235
  • SECURITY UPDATE: Namespace-separator insertions
    • debian/patches/CVE-2022-25236-*.patch: Protect against malicious namespace declarations in expat/lib/xmlparse.c, expat/tests/runtests.c.
    • CVE-2022-25236
  • debian/patches/fixing_tests.patch: fixing tests in order to it work in xenial and oldest releases.
Record
CLSA-2022-1660760528
Updated
2026-11-02
OSVCLSA-2022-1660762248 No score

Fixed 13 CVEs in expat

  • CVE-2022-25236: Fix insertion of namespace-separator characters into namespace URIs
  • CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to arbitrary code execution
  • CVE-2022-25315: Fix integer overflow in storeRawNames()
  • CVE-2022-22822: Fix integer overflow in addBinding()
  • CVE-2022-22823: Fix integer overflow in build_model()
  • CVE-2022-22824: Fix integer overflow in defineAttribute()
  • CVE-2022-22825: Fix integer overflow in lookup()
  • CVE-2022-22826: Fix integer overflow in nextScaffoldPart()
  • CVE-2022-22827: Fix integer overflow in storeAtts()
  • CVE-2022-23852: Fix integer overflow in XML_GetBuffer()
  • CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()
  • CVE-2021-45960: Fix troublesome left shifts in storeAtts()
  • CVE-2022-23990: Fix integer overflow in doProlog()
Record
CLSA-2022-1660762248
Updated
2026-11-02
OSVMGASA-2022-0031 No score

Updated expat packages fix security vulnerability

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). (CVE-2021-45960)

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. (CVE-2021-46143)

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22822)

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22823)

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22824)

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22825)

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22826)

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVE-2022-22827)

Record
MGASA-2022-0031
Updated
2026-11-02
OSVopenSUSE-SU-2022:0178-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2021-45960: Fixed left shift in the storeAtts function in xmlparse.c that can lead to realloc misbehavior (bsc#1194251).
  • CVE-2021-46143: Fixed integer overflow in m_groupSize in doProlog (bsc#1194362).
  • CVE-2022-22822: Fixed integer overflow in addBinding in xmlparse.c (bsc#1194474).
  • CVE-2022-22823: Fixed integer overflow in build_model in xmlparse.c (bsc#1194476).
  • CVE-2022-22824: Fixed integer overflow in defineAttribute in xmlparse.c (bsc#1194477).
  • CVE-2022-22825: Fixed integer overflow in lookup in xmlparse.c (bsc#1194478).
  • CVE-2022-22826: Fixed integer overflow in nextScaffoldPart in xmlparse.c (bsc#1194479).
  • CVE-2022-22827: Fixed integer overflow in storeAtts in xmlparse.c (bsc#1194480).
Record
openSUSE-SU-2022:0178-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11762-1 No score

expat-2.4.3-1.1 on GA media

These are all security issues fixed in the expat-2.4.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11762-1
Updated
2026-11-02
OSVSUSE-SU-2022:0178-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2021-45960: Fixed left shift in the storeAtts function in xmlparse.c that can lead to realloc misbehavior (bsc#1194251).
  • CVE-2021-46143: Fixed integer overflow in m_groupSize in doProlog (bsc#1194362).
  • CVE-2022-22822: Fixed integer overflow in addBinding in xmlparse.c (bsc#1194474).
  • CVE-2022-22823: Fixed integer overflow in build_model in xmlparse.c (bsc#1194476).
  • CVE-2022-22824: Fixed integer overflow in defineAttribute in xmlparse.c (bsc#1194477).
  • CVE-2022-22825: Fixed integer overflow in lookup in xmlparse.c (bsc#1194478).
  • CVE-2022-22826: Fixed integer overflow in nextScaffoldPart in xmlparse.c (bsc#1194479).
  • CVE-2022-22827: Fixed integer overflow in storeAtts in xmlparse.c (bsc#1194480).
Record
SUSE-SU-2022:0178-1
Updated
2026-11-02
OSVSUSE-SU-2022:0179-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2021-45960: Fixed left shift in the storeAtts function in xmlparse.c that can lead to realloc misbehavior (bsc#1194251).
  • CVE-2021-46143: Fixed integer overflow in m_groupSize in doProlog (bsc#1194362).
  • CVE-2022-22822: Fixed integer overflow in addBinding in xmlparse.c (bsc#1194474).
  • CVE-2022-22823: Fixed integer overflow in build_model in xmlparse.c (bsc#1194476).
  • CVE-2022-22824: Fixed integer overflow in defineAttribute in xmlparse.c (bsc#1194477).
  • CVE-2022-22825: Fixed integer overflow in lookup in xmlparse.c (bsc#1194478).
  • CVE-2022-22826: Fixed integer overflow in nextScaffoldPart in xmlparse.c (bsc#1194479).
  • CVE-2022-22827: Fixed integer overflow in storeAtts in xmlparse.c (bsc#1194480).
Record
SUSE-SU-2022:0179-1
Updated
2026-11-02
OSVSUSE-SU-2022:14878-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2021-45960: Fixed left shift in the storeAtts function in xmlparse.c that can lead to realloc misbehavior (bsc#1194251).
  • CVE-2021-46143: Fixed integer overflow in m_groupSize in doProlog (bsc#1194362).
  • CVE-2022-22822: Fixed integer overflow in addBinding in xmlparse.c (bsc#1194474).
  • CVE-2022-22823: Fixed integer overflow in build_model in xmlparse.c (bsc#1194476).
  • CVE-2022-22824: Fixed integer overflow in defineAttribute in xmlparse.c (bsc#1194477).
  • CVE-2022-22825: Fixed integer overflow in lookup in xmlparse.c (bsc#1194478).
  • CVE-2022-22826: Fixed integer overflow in nextScaffoldPart in xmlparse.c (bsc#1194479).
  • CVE-2022-22827: Fixed integer overflow in storeAtts in xmlparse.c (bsc#1194480).
Record
SUSE-SU-2022:14878-1
Updated
2026-11-02
OSVUSN-5288-1 No score

expat vulnerabilities

It was discovered that Expat incorrectly handled certain files. An attacker could possibly use this issue to cause a crash or execute arbitrary code.

Record
USN-5288-1
Updated
2026-11-02
OSVUSN-5455-1 No score

libxmltok vulnerabilities

Tim Boddy, Gustavo Grieco and others discovered that Expat, that is integrated in xmltok library, incorrectly handled certain files. An attacker could possibly use these issues to cause a denial of service, or possibly execute arbitrary code. These issues were only addressed in Ubuntu 16.04 ESM. (CVE-2012-1148, CVE-2015-1283, CVE-2016-0718, CVE-2016-4472, CVE-2018-20843, CVE-2019-15903, CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824, CVE-2022-22825, CVE-2022-22826, CVE-2022-22827)

It was discovered that Expat, that is integrated in xmltok library, incorrectly handled encoding validation of certain files. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2022-25235)

It was discovered that Expat, that is integrated in xmltok library, incorrectly handled namespace URIs of certain files. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2022-25236)

Record
USN-5455-1
Updated
2026-11-02
OSVUSN-7199-1 No score

libxmltok vulnerabilities

It was discovered that Expat, contained within the xmltok library, incorrectly handled malformed XML data. If a user or application were tricked into opening a crafted XML file, an attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2015-1283, CVE-2016-0718, CVE-2016-4472, CVE-2019-15903)

It was discovered that Expat, contained within the xmltok library, incorrectly handled XML data containing a large number of colons, which could lead to excessive resource consumption. If a user or application were tricked into opening a crafted XML file, an attacker could possibly use this issue to cause a denial of service. (CVE-2018-20843)

It was discovered that Expat, contained within the xmltok library, incorrectly handled certain input, which could lead to an integer overflow. If a user or application were tricked into opening a crafted XML file, an attacker could possibly use this issue to cause a denial of service. (CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824, CVE-2022-22825, CVE-2022-22826, CVE-2022-22827)

Record
USN-7199-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
expat
Alpine:v3.12
 before 2.2.10-r0
2.2.10-r0
expat
Alpine:v3.13
 before 2.2.10-r2
2.2.10-r2
expat
Alpine:v3.14
 before 2.4.3-r0
2.4.3-r0
expat
Alpine:v3.15
 before 2.4.3-r0
2.4.3-r0
expat
Alpine:v3.16
 before 2.4.3-r0
2.4.3-r0
expat
Alpine:v3.17
 before 2.4.3-r0
2.4.3-r0
expat
Alpine:v3.18
 before 2.4.3-r0
2.4.3-r0
expat
Alpine:v3.19
 before 2.4.3-r0
2.4.3-r0
expat
Alpine:v3.20
 before 2.4.3-r0
2.4.3-r0
expat
Alpine:v3.21
 before 2.4.3-r0
2.4.3-r0
Show 204 moreShow less
Affected packages
PackageAffectedFixed
expat
Alpine:v3.22
 before 2.4.3-r0
2.4.3-r0
expat
Alpine:v3.23
 before 2.4.3-r0
2.4.3-r0
expat
Alpine:v3.24
 before 2.4.3-r0
2.4.3-r0
expat
AlmaLinux:8
 before 2.2.5-8.el8_6.2
2.2.5-8.el8_6.2
expat-devel
AlmaLinux:8
 before 2.2.5-8.el8_6.2
2.2.5-8.el8_6.2
xmlrpc-c
AlmaLinux:8
 before 1.51.0-8.el8
1.51.0-8.el8
xmlrpc-c-c++
AlmaLinux:8
 before 1.51.0-8.el8
1.51.0-8.el8
xmlrpc-c-client
AlmaLinux:8
 before 1.51.0-8.el8
1.51.0-8.el8
xmlrpc-c-client++
AlmaLinux:8
 before 1.51.0-8.el8
1.51.0-8.el8
xmlrpc-c-devel
AlmaLinux:8
 before 1.51.0-8.el8
1.51.0-8.el8
expat
Azure Linux:2
 before 2.4.3-1
2.4.3-1
expat
TuxCare:CentOS:8.4
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat-devel
TuxCare:CentOS:8.4
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat-static
TuxCare:CentOS:8.4
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat
TuxCare:CentOS:8.5
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat-devel
TuxCare:CentOS:8.5
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat-static
TuxCare:CentOS:8.5
 before 2.2.5-4.el8.tuxcare.els1
2.2.5-4.el8.tuxcare.els1
expat
TuxCare:OracleLinux:6
 before 2.0.1-13.el6_8.tuxcare.els1
2.0.1-13.el6_8.tuxcare.els1
expat-devel
TuxCare:OracleLinux:6
 before 2.0.1-13.el6_8.tuxcare.els1
2.0.1-13.el6_8.tuxcare.els1
expat
TuxCare:Ubuntu:16.04
 before 2.1.0-7ubuntu0.16.04.5+tuxcare.els1
2.1.0-7ubuntu0.16.04.5+tuxcare.els1
libexpat1
TuxCare:Ubuntu:16.04
 before 2.1.0-7ubuntu0.16.04.5+tuxcare.els1
2.1.0-7ubuntu0.16.04.5+tuxcare.els1
libexpat1-dev
TuxCare:Ubuntu:16.04
 before 2.1.0-7ubuntu0.16.04.5+tuxcare.els1
2.1.0-7ubuntu0.16.04.5+tuxcare.els1
expat
TuxCare:CentOS:6
 before 2.0.1-13.el6_8.tuxcare.els1
2.0.1-13.el6_8.tuxcare.els1
expat-devel
TuxCare:CentOS:6
 before 2.0.1-13.el6_8.tuxcare.els1
2.0.1-13.el6_8.tuxcare.els1
expat
Debian:12
 before 2.4.3-1
2.4.3-1
expat
Debian:13
 before 2.4.3-1
2.4.3-1
expat
Debian:14
 before 2.4.3-1
2.4.3-1
libxmltok
Debian:12
 All versions, plus listed versions
1.2-41.2-4.11.2-4.1~exp11.2-4.2
 None known
expat
Debian:9
 before 2.2.0-2+deb9u4, plus listed versions
2.2.0-22.2.0-2+deb9u12.2.0-2+deb9u22.2.0-2+deb9u3
2.2.0-2+deb9u4
expat
Debian:10
 before 2.2.6-2+deb10u2, plus listed versions
2.2.6-22.2.6-2+deb10u1
2.2.6-2+deb10u2
expat
Debian:11
 before 2.2.10-2+deb11u1, plus listed versions
2.2.10-2
2.2.10-2+deb11u1
Expat_jll
Julia
 before 2.4.4+0
2.4.4+0
expat
Mageia:8
 before 2.2.10-1.1.mga8
2.2.10-1.1.mga8
expat
openEuler:20.03-LTS-SP1
 before 2.2.9-4.oe1
2.2.9-4.oe1
expat
openEuler:20.03-LTS-SP2
 before 2.2.9-4.oe1
2.2.9-4.oe1
expat
openEuler:20.03-LTS-SP3
 before 2.2.9-4.oe1
2.2.9-4.oe1
firefox
openEuler:20.03-LTS-SP1
 before 79.0-12.oe1
79.0-12.oe1
firefox
openEuler:20.03-LTS-SP3
 before 79.0-12.oe1
79.0-12.oe1
expat-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat-devel
Red Hat:enterprise_linux:9::appstream
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat
Red Hat:enterprise_linux:9::baseos
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat-debugsource
Red Hat:enterprise_linux:9::baseos
 before 0:2.2.10-12.el9_0
0:2.2.10-12.el9_0
expat
Red Hat:enterprise_linux:8::baseos
 before 0:2.2.5-4.el8_5.3
0:2.2.5-4.el8_5.3
expat-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:2.2.5-4.el8_5.3
0:2.2.5-4.el8_5.3
expat-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:2.2.5-4.el8_5.3
0:2.2.5-4.el8_5.3
expat-devel
Red Hat:enterprise_linux:8::baseos
 before 0:2.2.5-4.el8_5.3
0:2.2.5-4.el8_5.3
expat
Red Hat:enterprise_linux:7::client
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-devel
Red Hat:enterprise_linux:7::client
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-static
Red Hat:enterprise_linux:7::client
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-devel
Red Hat:enterprise_linux:7::computenode
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-static
Red Hat:enterprise_linux:7::computenode
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat
Red Hat:enterprise_linux:7::server
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-devel
Red Hat:enterprise_linux:7::server
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-static
Red Hat:enterprise_linux:7::server
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat
Red Hat:enterprise_linux:7::workstation
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-devel
Red Hat:enterprise_linux:7::workstation
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
expat-static
Red Hat:enterprise_linux:7::workstation
 before 0:2.1.0-14.el7_9
0:2.1.0-14.el7_9
xmlrpc-c
Red Hat:enterprise_linux:8::baseos
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-apps-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-c++-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-client++-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-client
Red Hat:enterprise_linux:8::baseos
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-client-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-apps-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-c++
Red Hat:enterprise_linux:8::crb
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-c++-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-client++
Red Hat:enterprise_linux:8::crb
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-client++-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-client-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
xmlrpc-c-devel
Red Hat:enterprise_linux:8::crb
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
expat
Red Hat:rhel_aus:8.4::baseos
 before 0:2.2.10-1.el8_4
0:2.2.10-1.el8_4
expat
Red Hat:rhel_eus_long_life:8.4::baseos
 before 0:2.2.10-1.el8_4
0:2.2.10-1.el8_4
expat
Red Hat:rhel_aus:8.2::baseos
 before 0:2.2.10-1.el8_2
0:2.2.10-1.el8_2
expat
Rocky Linux:8
 before 0:2.2.5-4.el8_5.3
0:2.2.5-4.el8_5.3
xmlrpc-c
Rocky Linux:8
 before 0:1.51.0-8.el8
0:1.51.0-8.el8
expat
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise Server 15-LTSS
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise Server 15 SP2-BCL
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Manager Proxy 4.1
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Manager Retail Branch Server 4.1
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Manager Server 4.1
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise Micro 5.0
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Linux Enterprise Micro 5.1
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Enterprise Storage 6
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:Enterprise Storage 7
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
SUSE:HPE Helion OpenStack 8
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:OpenStack Cloud 8
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:OpenStack Cloud 9
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:OpenStack Cloud Crowbar 8
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:OpenStack Cloud Crowbar 9
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:Linux Enterprise Server 12 SP5
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 2.1.0-21.12.1
2.1.0-21.12.1
expat
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 2.0.1-88.42.12.1
2.0.1-88.42.12.1
expat
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 2.0.1-88.42.12.1
2.0.1-88.42.12.1
expat
Ubuntu:Pro:14.04:LTS
 before 2.1.0-4ubuntu1.4+esm4, plus listed versions
2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.12.1.0-4ubuntu1.22.1.0-4ubuntu1.32.1.0-4ubuntu1.42.1.0-4ubuntu1.4+esm12.1.0-4ubuntu1.4+esm2
2.1.0-4ubuntu1.4+esm4
coin3
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50-33.1.4~abc9f50-43.1.4~abc9f50-4ubuntu23.1.4~abc9f50-4ubuntu2+esm13.1.4~abc9f50-4ubuntu2+esm2
 None known
vnc4
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37ubuntu54.1.1+xorg4.3.0-37ubuntu5.0.14.1.1+xorg4.3.0-37ubuntu5.0.24.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
 None known
vtk
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
5.8.0-14ubuntu15.8.0-14ubuntu35.8.0-14.1ubuntu25.8.0-14.1ubuntu35.8.0-14.1ubuntu3+esm1
 None known
xmlrpc-c
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.16.33-3.2ubuntu31.33.06-0ubuntu11.33.06-0ubuntu1+esm1
 None known
expat
Ubuntu:Pro:16.04:LTS
 before 2.1.0-7ubuntu0.16.04.5+esm2, plus listed versions
2.1.0-72.1.0-7ubuntu0.16.04.12.1.0-7ubuntu0.16.04.22.1.0-7ubuntu0.16.04.32.1.0-7ubuntu0.16.04.42.1.0-7ubuntu0.16.04.5
2.1.0-7ubuntu0.16.04.5+esm2
libxmltok
Ubuntu:Pro:16.04:LTS
 before 1.2-3ubuntu0.16.04.1~esm2, plus listed versions
1.2-3build31.2-3ubuntu0.16.04.1~esm1
1.2-3ubuntu0.16.04.1~esm2
ayttm
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.6.3-3build10.6.3-3ubuntu0.1~esm1
 None known
cableswig
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.1.0+git20150808-10.1.0+git20150808-20.1.0+git20150808-2ubuntu0.1~esm1
 None known
cadaver
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.23.3-2ubuntu2
 None known
coin3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
 None known
insighttoolkit
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.20.1+git20120521-63.20.1+git20120521-6build13.20.1+git20120521-6ubuntu0.1~esm1
 None known
insighttoolkit4
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.8.1-1ubuntu34.8.1-1ubuntu44.8.2-3.1ubuntu14.9.0-3ubuntu24.9.0-4ubuntu14.9.0-4ubuntu1.1
 None known
matanza
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.13+ds1-5
 None known
swish-e
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.4.7-42.4.7-4build12.4.7-4ubuntu0.1~esm1
 None known
tdom
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.8.3-1
 None known
vnc4
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu24.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
 None known
vtk
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
5.10.1+dfsg-25.10.1+dfsg-2build35.10.1+dfsg-2.1build15.10.1+dfsg-2.1ubuntu0.1~esm1
 None known
wbxml2
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.10.7-1
 None known
xmlrpc-c
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.33.14-0.2ubuntu31.33.14-1ubuntu11.33.14-1ubuntu1+esm1
 None known
expat
Ubuntu:18.04:LTS
 before 2.2.5-3ubuntu0.4, plus listed versions
2.2.3-12.2.3-22.2.5-0ubuntu22.2.5-32.2.5-3ubuntu0.12.2.5-3ubuntu0.2
2.2.5-3ubuntu0.4
firefox
Ubuntu:18.04:LTS
 before 98.0+build3-0ubuntu0.18.04.2, plus listed versions
56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu1
Show 45 moreShow less
60.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.362.0+build2-0ubuntu0.18.04.462.0+build2-0ubuntu0.18.04.562.0.3+build1-0ubuntu0.18.04.163.0+build2-0ubuntu0.18.04.263.0.3+build1-0ubuntu0.18.04.164.0+build3-0ubuntu0.18.04.165.0+build2-0ubuntu0.18.04.165.0.1+build2-0ubuntu0.18.04.166.0+build3-0ubuntu0.18.04.166.0.1+build1-0ubuntu0.18.04.166.0.2+build1-0ubuntu0.18.04.166.0.3+build1-0ubuntu0.18.04.166.0.4+build3-0ubuntu0.18.04.166.0.5+build1-0ubuntu0.18.04.167.0+build2-0ubuntu0.18.04.167.0.1+build1-0ubuntu0.18.04.167.0.2+build2-0ubuntu0.18.04.167.0.3+build1-0ubuntu0.18.04.167.0.4+build1-0ubuntu0.18.04.168.0+build3-0ubuntu0.18.04.168.0.1+build1-0ubuntu0.18.04.168.0.2+build1-0ubuntu0.18.04.169.0+build2-0ubuntu0.18.04.169.0.1+build1-0ubuntu0.18.04.169.0.2+build1-0ubuntu0.18.04.170.0+build2-0ubuntu0.18.04.170.0.1+build1-0ubuntu0.18.04.171.0+build5-0ubuntu0.18.04.172.0.1+build1-0ubuntu0.18.04.172.0.2+build1-0ubuntu0.18.04.173.0+build3-0ubuntu0.18.04.173.0.1+build1-0ubuntu0.18.04.174.0+build3-0ubuntu0.18.04.174.0.1+build1-0ubuntu0.18.04.175.0+build3-0ubuntu0.18.04.176.0+build2-0ubuntu0.18.04.176.0.1+build1-0ubuntu0.18.04.177.0.1+build1-0ubuntu0.18.04.178.0.1+build1-0ubuntu0.18.04.178.0.2+build2-0ubuntu0.18.04.1
98.0+build3-0ubuntu0.18.04.2
cadaver
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.23.3-2ubuntu3
 None known
coin3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-23.1.4~abc9f50+dfsg2-13.1.4~abc9f50+dfsg3-13.1.4~abc9f50+dfsg3-23.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
 None known
libxmltok
Ubuntu:Pro:18.04:LTS
 before 1.2-4ubuntu0.18.04.1~esm4, plus listed versions
1.2-41.2-4ubuntu0.18.04.1~esm11.2-4ubuntu0.18.04.1~esm21.2-4ubuntu0.18.04.1~esm3
1.2-4ubuntu0.18.04.1~esm4
matanza
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.13+ds1-5build10.13+ds1-6
 None known
swish-e
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.4.7-5ubuntu12.4.7-5ubuntu1+esm1
 None known
tdom
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.8.3-10.9.0-1
 None known
vnc4
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu2
 None known
wbxml2
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.10.7-10.10.7-1build1
 None known
xmlrpc-c
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.33.14-71.33.14-81.33.14-8build11.33.14-8ubuntu0.18.04.1~esm1
 None known
expat
Ubuntu:20.04:LTS
 before 2.2.9-1ubuntu0.2, plus listed versions
2.2.7-22.2.9-12.2.9-1build1
2.2.9-1ubuntu0.2
firefox
Ubuntu:20.04:LTS
 before 98.0+build3-0ubuntu0.20.04.2, plus listed versions
69.0.3+build1-0ubuntu170.0+build2-0ubuntu170.0+build2-0ubuntu270.0.1+build1-0ubuntu271.0+build2-0ubuntu2
Show 45 moreShow less
71.0+build5-0ubuntu172.0.1+build1-0ubuntu172.0.2+build1-0ubuntu173.0+build1-0ubuntu173.0+build2-0ubuntu173.0+build3-0ubuntu173.0.1+build1-0ubuntu174.0+build1-0ubuntu174.0+build2-0ubuntu174.0+build2-0ubuntu274.0+build3-0ubuntu175.0+build3-0ubuntu176.0+build2-0ubuntu0.20.04.176.0.1+build1-0ubuntu0.20.04.177.0.1+build1-0ubuntu0.20.04.178.0.1+build1-0ubuntu0.20.04.178.0.2+build2-0ubuntu0.20.04.179.0+build1-0ubuntu0.20.04.180.0+build2-0ubuntu0.20.04.180.0.1+build1-0ubuntu0.20.04.181.0+build2-0ubuntu0.20.04.181.0.2+build1-0ubuntu0.20.04.182.0+build2-0ubuntu0.20.04.182.0.2+build1-0ubuntu0.20.04.182.0.3+build1-0ubuntu0.20.04.183.0+build2-0ubuntu0.20.04.184.0+build3-0ubuntu0.20.04.184.0.1+build1-0ubuntu0.20.04.184.0.2+build1-0ubuntu0.20.04.185.0+build1-0ubuntu0.20.04.185.0.1+build1-0ubuntu0.20.04.186.0+build3-0ubuntu0.20.04.186.0.1+build1-0ubuntu0.20.04.187.0+build3-0ubuntu0.20.04.288.0+build2-0ubuntu0.20.04.188.0.1+build1-0ubuntu0.20.04.289.0+build2-0ubuntu0.20.04.289.0.1+build1-0ubuntu0.20.04.189.0.2+build1-0ubuntu0.20.04.190.0+build1-0ubuntu0.20.04.190.0.2+build1-0ubuntu0.20.04.191.0+build2-0ubuntu0.20.04.191.0.1+build1-0ubuntu0.20.04.191.0.2+build1-0ubuntu0.20.04.192.0+build3-0ubuntu0.20.04.1
98.0+build3-0ubuntu0.20.04.2
thunderbird
Ubuntu:20.04:LTS
 before 1:91.11.0+build2-0ubuntu0.20.04.1, plus listed versions
1:68.1.2+build1-0ubuntu11:68.1.2+build1-0ubuntu21:68.2.1+build1-0ubuntu11:68.2.2+build1-0ubuntu11:68.3.0+build2-0ubuntu1
Show 19 moreShow less
1:68.3.1+build1-0ubuntu21:68.4.1+build1-0ubuntu11:68.4.2+build2-0ubuntu11:68.5.0+build1-0ubuntu11:68.6.0+build2-0ubuntu11:68.7.0+build1-0ubuntu11:68.7.0+build1-0ubuntu21:68.8.0+build2-0ubuntu0.20.04.21:68.10.0+build1-0ubuntu0.20.04.11:78.7.1+build1-0ubuntu0.20.04.11:78.8.1+build1-0ubuntu0.20.04.11:78.11.0+build1-0ubuntu0.20.04.21:78.13.0+build1-0ubuntu0.20.04.21:78.14.0+build1-0ubuntu0.20.04.11:78.14.0+build1-0ubuntu0.20.04.21:91.5.0+build1-0ubuntu0.20.04.11:91.7.0+build2-0ubuntu0.20.04.11:91.8.1+build1-0ubuntu0.20.04.11:91.9.1+build1-0ubuntu0.20.04.1
1:91.11.0+build2-0ubuntu0.20.04.1
cadaver
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.23.3-2.1build1
 None known
libxmltok
Ubuntu:Pro:20.04:LTS
 before 1.2-4ubuntu0.20.04.1~esm4, plus listed versions
1.2-41.2-4ubuntu0.20.04.1~esm11.2-4ubuntu0.20.04.1~esm21.2-4ubuntu0.20.04.1~esm3
1.2-4ubuntu0.20.04.1~esm4
matanza
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.13+ds1-60.13+ds2-1
 None known
swish-e
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.4.7-6build12.4.7-6build22.4.7-6ubuntu0.1~esm1
 None known
tdom
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.9.1-1
 None known
wbxml2
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.10.7-1build1
 None known
xmlrpc-c
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.33.14-8build11.33.14-8build21.33.14-8ubuntu0.20.04.1~esm1
 None known
cadaver
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.23.3-2.1build1
 None known
expat
Ubuntu:22.04:LTS
 before 2.4.3-1, plus listed versions
2.4.1-22.4.1-32.4.2-1
2.4.3-1
firefox
Ubuntu:22.04:LTS
 before 1:1snap1-0ubuntu1, plus listed versions
93.0+build1-0ubuntu394.0+build3-0ubuntu194.0.2+build1-0ubuntu194.0.2+build2-0ubuntu195.0+build1-0ubuntu1
Show 9 moreShow less
95.0.1+build2-0ubuntu195.0.2+build1-0ubuntu196.0+build2-0ubuntu196.0.1+build1-0ubuntu196.0.2+build1-0ubuntu196.0.3+build1-0ubuntu197.0+build1-0ubuntu197.0+build2-0ubuntu197.0.1+build1-0ubuntu1
1:1snap1-0ubuntu1
matanza
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.13+ds2-1
 None known
tdom
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.9.2-1
 None known
thunderbird
Ubuntu:22.04:LTS
 before 1:91.11.0+build2-0ubuntu0.22.04.1, plus listed versions
1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1
Show 8 moreShow less
1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.1
1:91.11.0+build2-0ubuntu0.22.04.1
wbxml2
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.10.7-1build10.11.7+dfsg-1
 None known
libxmltok
Ubuntu:Pro:22.04:LTS
 before 1.2-4ubuntu0.22.04.1~esm4, plus listed versions
1.2-41.2-4ubuntu0.22.04.1~esm11.2-4ubuntu0.22.04.1~esm21.2-4ubuntu0.22.04.1~esm3
1.2-4ubuntu0.22.04.1~esm4
swish-e
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.4.7-6build32.4.7-6.12.4.7-6.1build12.4.7-6.1ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.33.14-91.33.14-101.33.14-10ubuntu0.1~esm1
 None known
cadaver
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.24+dfsg-20.24+dfsg-30.24+dfsg-3build10.24+dfsg-3build2
 None known
matanza
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.13+ds2-10.13+ds2-1build10.13+ds2-1build2
 None known
tdom
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.9.3-10.9.3-1build1
 None known
wbxml2
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.11.8+dfsg-30.11.8+dfsg-3build1
 None known
libxmltok
Ubuntu:Pro:24.04:LTS
 before 1.2-4.1ubuntu2.24.0.4.1+esm2, plus listed versions
1.2-4ubuntu11.2-4.1ubuntu11.2-4.1ubuntu21.2-4.1ubuntu2.24.0.4.1+esm1
1.2-4.1ubuntu2.24.0.4.1+esm2
swish-e
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.4.7-6.22.4.7-6.2build12.4.7-6.2build22.4.7-6.2build32.4.7-6.2ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.33.14-111.33.14-11.11.33.14-121.33.14-12build11.33.14-12build21.33.14-12ubuntu0.1~esm1
 None known
cadaver
Ubuntu:25.10
 All versions, plus listed versions
0.26+dfsg-2
 None known
matanza
Ubuntu:25.10
 All versions, plus listed versions
0.13+ds2-2
 None known
swish-e
Ubuntu:25.10
 All versions, plus listed versions
2.4.7-6.32.4.7-6.3build12.4.7-7
 None known
tdom
Ubuntu:25.10
 All versions, plus listed versions
0.9.5.1-20.9.5.1-3
 None known
wbxml2
Ubuntu:25.10
 All versions, plus listed versions
0.11.10+dfsg-2
 None known
xmlrpc-c
Ubuntu:25.10
 All versions, plus listed versions
1.59.03-71.59.03-91.59.03-101.59.03-10.1
 None known
cadaver
Ubuntu:26.10
 All versions, plus listed versions
0.28+dfsg-2
 None known
matanza
Ubuntu:26.10
 All versions, plus listed versions
0.13+ds2-2build1
 None known
swish-e
Ubuntu:26.10
 All versions, plus listed versions
2.4.7-7.12.4.7-7.22.4.7-7.2build1
 None known
tdom
Ubuntu:26.10
 All versions, plus listed versions
0.9.6-20.9.6-3
 None known
wbxml2
Ubuntu:26.10
 All versions, plus listed versions
0.11.10+dfsg-30.11.10+dfsg-4
 None known
xmlrpc-c
Ubuntu:26.10
 All versions, plus listed versions
1.60.05-11.60.05-1build1
 None known
cadaver
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.26+dfsg-20.28+dfsg-10.28+dfsg-2
 None known
matanza
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.13+ds2-20.13+ds2-2build1
 None known
tdom
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.9.5.1-30.9.6-2
 None known
wbxml2
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.11.10+dfsg-20.11.10+dfsg-2build10.11.10+dfsg-3
 None known
xmlrpc-c
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.59.03-10.11.60.05-1
 None known
swish-e
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.4.7-72.4.7-7.12.4.7-7.1ubuntu0.1~esm1
 None known
libxmltok
Ubuntu:Pro:18.04:LTS
 before 1.2-4ubuntu0.18.04.1~esm1, plus listed versions
1.2-4
1.2-4ubuntu0.18.04.1~esm1
libxmltok
Ubuntu:Pro:20.04:LTS
 before 1.2-4ubuntu0.20.04.1~esm1, plus listed versions
1.2-4
1.2-4ubuntu0.20.04.1~esm1
libxmltok
Ubuntu:Pro:22.04:LTS
 before 1.2-4ubuntu0.22.04.1~esm1, plus listed versions
1.2-4
1.2-4ubuntu0.22.04.1~esm1
expat
openSUSE:Leap 15.3
 before 2.2.5-3.9.1
2.2.5-3.9.1
expat
openSUSE:Tumbleweed
 before 2.4.3-1.1
2.4.3-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-22827 is a high vulnerability (CVSS 8.8) in Libexpat Project Libexpat, published January 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.18%, the 88th percentile. Fixed in expat 2.2.10-r0.

References

Show 189 moreShow less
This page doesn't list everything

Left out here: 42 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open