Every CVE Search/ Get API key

CVE-2017-9233

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows...

7.5 HighFix available

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

8.74%Up 6.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

Record
CVE-2017-9233
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-611, CWE-835
Updated
2026-11-02
CVE List No score

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

Record
CVE-2017-9233
Updated
2026-11-02
EUVDEUVD-2017-18171 No score

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

Record
EUVD-2017-18171
Updated
2026-11-02
GitHub AdvisoriesGHSA-6j8w-m4cc-r7hm 7.5

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows...

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

Record
GHSA-6j8w-m4cc-r7hm
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-611
Updated
2026-11-02
OSVALPINE-CVE-2017-9233 7.5

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

Record
ALPINE-CVE-2017-9233
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2017-9233 7.5

CVE-2017-9233 does not affect BellSoft software

Record
BELL-CVE-2017-9233
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 18 moreShow less
OSV 7.5

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

Record
CVE-2017-9233
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVDEBIAN-CVE-2017-9233 7.5

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

Record
DEBIAN-CVE-2017-9233
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-9233 7.5

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

Record
UBUNTU-CVE-2017-9233
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1776440644 No score

expat: Fix of 4 CVEs

  • CVE-2017-9233: fix external entity infinite loop in entityValueInitProcessor and entityValueProcessor
  • CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of large tokens in small buffer refills; fix buffer growth calculation
  • CVE-2013-0340: add billion laughs (entity expansion bomb) attack protection with amplification limit (100x max, 8 MiB activation threshold); includes fix for isolated external parser bypass (CVE-2024-28757)
  • CVE-2024-28757: add billion laughs (entity expansion bomb) attack protection with amplification limit (100x max, 8 MiB activation threshold); includes fix for isolated external parser bypass (CVE-2024-28757)
Record
CLSA-2026-1776440644
Updated
2026-11-02
OSVCLSA-2026-1776441540 No score

expat: Fix of 4 CVEs

  • CVE-2017-9233: fix external entity infinite loop in entityValueInitProcessor and entityValueProcessor
  • CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of large tokens in small buffer refills; fix buffer growth calculation
  • CVE-2013-0340: add billion laughs (entity expansion bomb) attack protection with amplification limit (100x max, 8 MiB activation threshold); includes fix for isolated external parser bypass (CVE-2024-28757)
  • CVE-2024-28757: add billion laughs (entity expansion bomb) attack protection with amplification limit (100x max, 8 MiB activation threshold); includes fix for isolated external parser bypass (CVE-2024-28757)
Record
CLSA-2026-1776441540
Updated
2026-11-02
OSVCLSA-2026-1776441769 No score

expat: Fix of 4 CVEs

  • CVE-2017-9233: fix external entity infinite loop in entityValueInitProcessor and entityValueProcessor
  • CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of large tokens in small buffer refills; fix buffer growth calculation
  • CVE-2013-0340: add billion laughs (entity expansion bomb) attack protection with amplification limit (100x max, 8 MiB activation threshold); includes fix for isolated external parser bypass (CVE-2024-28757)
  • CVE-2024-28757: add billion laughs (entity expansion bomb) attack protection with amplification limit (100x max, 8 MiB activation threshold); includes fix for isolated external parser bypass (CVE-2024-28757)
Record
CLSA-2026-1776441769
Updated
2026-11-02
OSVCLSA-2026-1777304792 No score

expat: Fix of 3 CVEs

  • CVE-2017-9233: Fix external entity infinite loop bug
  • CVE-2018-20843: Fix extraction of namespace prefix from XML name
  • CVE-2019-15903: Deny internal entities closing the doctype (heap overread)
Record
CLSA-2026-1777304792
Updated
2026-11-02
OSVCLSA-2026-1777305047 No score

expat: Fix of 3 CVEs

  • CVE-2017-9233: Fix external entity infinite loop bug
  • CVE-2018-20843: Fix extraction of namespace prefix from XML name
  • CVE-2019-15903: Deny internal entities closing the doctype (heap overread)
Record
CLSA-2026-1777305047
Updated
2026-11-02
OSVMGASA-2017-0214 No score

Updated expat packages fix security vulnerabilities

Gustavo Grieco discovered an integer overflow flaw during parsing of XML. An attacker can take advantage of this flaw to cause a denial of service against an application using the Expat library (CVE-2016-9063).

Rhodri James discovered an infinite loop vulnerability within the entityValueInitProcessor() function while parsing malformed XML in an external entity. An attacker can take advantage of this flaw to cause a denial of service against an application using the Expat library (CVE-2017-9233).

Record
MGASA-2017-0214
Updated
2026-11-02
OSVopenSUSE-SU-2024:10748-1 No score

expat-2.4.1-1.2 on GA media

These are all security issues fixed in the expat-2.4.1-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10748-1
Updated
2026-11-02
OSVPSF-2017-7 No score

Expat 2.2.1

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

Record
PSF-2017-7
Updated
2026-11-02
OSVSUSE-SU-2017:2299-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2016-9063: Possible integer overflow to fix inside XML_Parse leading to unexpected behaviour (bsc#1047240)
  • CVE-2017-9233: External Entity Vulnerability could lead to denial of service (bsc#1047236)
Record
SUSE-SU-2017:2299-1
Updated
2026-11-02
OSVSUSE-SU-2017:2375-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2016-9063: Possible integer overflow to fix inside XML_Parse leading to unexpected behaviour (bsc#1047240)
  • CVE-2017-9233: External Entity Vulnerability could lead to denial of service (bsc#1047236)
Record
SUSE-SU-2017:2375-1
Updated
2026-11-02
OSVSUSE-SU-2017:2699-1 No score

Security update for SLES 12 Docker image

The SUSE Linux Enterprise Server 12 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

  • Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
  • Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE cross-reference is available below.

pam:

  • CVE-2015-3238

libtasn1:

  • CVE-2015-3622
  • CVE-2016-4008

libidn:

  • CVE-2015-2059
  • CVE-2015-8948
  • CVE-2016-6261
  • CVE-2016-6262
  • CVE-2016-6263

zlib:

  • CVE-2016-9840
  • CVE-2016-9841
  • CVE-2016-9842
  • CVE-2016-9843

curl:

  • CVE-2016-5419
  • CVE-2016-5420
  • CVE-2016-5421
  • CVE-2016-7141
  • CVE-2016-7167
  • CVE-2016-8615
  • CVE-2016-8616
  • CVE-2016-8617
  • CVE-2016-8618
  • CVE-2016-8619
  • CVE-2016-8620
  • CVE-2016-8621
  • CVE-2016-8622
  • CVE-2016-8623
  • CVE-2016-8624
  • CVE-2016-9586
  • CVE-2017-1000100
  • CVE-2017-1000101
  • CVE-2017-7407

openssl:

  • CVE-2016-2105
  • CVE-2016-2106
  • CVE-2016-2107
  • CVE-2016-2108
  • CVE-2016-2109
  • CVE-2016-2177
  • CVE-2016-2178
  • CVE-2016-2179
  • CVE-2016-2180
  • CVE-2016-2181
  • CVE-2016-2182
  • CVE-2016-2183
  • CVE-2016-6302
  • CVE-2016-6303
  • CVE-2016-6304
  • CVE-2016-6306

libxml2:

  • CVE-2014-0191
  • CVE-2015-8806
  • CVE-2016-1762
  • CVE-2016-1833
  • CVE-2016-1834
  • CVE-2016-1835
  • CVE-2016-1837
  • CVE-2016-1838
  • CVE-2016-1839
  • CVE-2016-1840
  • CVE-2016-2073
  • CVE-2016-3627
  • CVE-2016-3705
  • CVE-2016-4447
  • CVE-2016-4448
  • CVE-2016-4449
  • CVE-2016-4483
  • CVE-2016-4658
  • CVE-2016-9318
  • CVE-2016-9597
  • CVE-2017-9047
  • CVE-2017-9048
  • CVE-2017-9049
  • CVE-2017-9050

util-linux:

  • CVE-2015-5218
  • CVE-2016-5011
  • CVE-2017-2616

cracklib:

  • CVE-2016-6318

systemd:

  • CVE-2014-9770
  • CVE-2015-8842
  • CVE-2016-7796

pcre:

  • CVE-2014-8964
  • CVE-2015-2325
  • CVE-2015-2327
  • CVE-2015-2328
  • CVE-2015-3210
  • CVE-2015-3217
  • CVE-2015-5073
  • CVE-2015-8380
  • CVE-2015-8381
  • CVE-2015-8382
  • CVE-2015-8383
  • CVE-2015-8384
  • CVE-2015-8385
  • CVE-2015-8386
  • CVE-2015-8387
  • CVE-2015-8388
  • CVE-2015-8389
  • CVE-2015-8390
  • CVE-2015-8391
  • CVE-2015-8392
  • CVE-2015-8393
  • CVE-2015-8394
  • CVE-2015-8395
  • CVE-2016-1283
  • CVE-2016-3191

appamor:

  • CVE-2017-6507

bash:

  • CVE-2014-6277
  • CVE-2014-6278
  • CVE-2016-0634
  • CVE-2016-7543

cpio:

  • CVE-2016-2037

glibc:

  • CVE-2016-1234
  • CVE-2016-3075
  • CVE-2016-3706
  • CVE-2016-4429
  • CVE-2017-1000366

perl:

  • CVE-2015-8853
  • CVE-2016-1238
  • CVE-2016-2381
  • CVE-2016-6185

libssh2_org:

  • CVE-2016-0787

expat:

  • CVE-2012-6702
  • CVE-2015-1283
  • CVE-2016-0718
  • CVE-2016-5300
  • CVE-2016-9063
  • CVE-2017-9233

ncurses:

  • CVE-2017-10684
  • CVE-2017-10685
  • CVE-2017-11112
  • CVE-2017-11113

libksba:

  • CVE-2016-4574
  • CVE-2016-4579

libgcrypt:

  • CVE-2015-7511
  • CVE-2016-6313
  • CVE-2017-7526

dbus-1:

  • CVE-2014-7824
  • CVE-2015-0245

Finally, the following packages received non-security fixes:

  • augeas
  • bzip2
  • ca-certificates-mozilla
  • coreutils
  • cryptsetup
  • cyrus-sasl
  • dirmngr
  • e2fsprogs
  • findutils
  • gpg2
  • insserv-compat
  • kmod
  • libcap
  • libsolv
  • libzypp
  • openldap2
  • p11-kit
  • permissions
  • procps
  • rpm
  • sed
  • shadow
  • zypper
Record
SUSE-SU-2017:2699-1
Updated
2026-11-02
OSVSUSE-SU-2017:2700-1 No score

Security update for SLES 12-SP1 Docker image

The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

  • Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
  • Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE cross-reference is available below.

pam:

  • CVE-2015-3238

libtasn1:

  • CVE-2015-3622
  • CVE-2016-4008

expat:

expat:

  • CVE-2012-6702
  • CVE-2015-1283
  • CVE-2016-0718
  • CVE-2016-5300
  • CVE-2016-9063
  • CVE-2017-9233

libidn:

  • CVE-2015-2059
  • CVE-2015-8948
  • CVE-2016-6261
  • CVE-2016-6262
  • CVE-2016-6263

zlib:

  • CVE-2016-9840
  • CVE-2016-9841
  • CVE-2016-9842
  • CVE-2016-9843

curl:

  • CVE-2016-5419
  • CVE-2016-5420
  • CVE-2016-5421
  • CVE-2016-7141
  • CVE-2016-7167
  • CVE-2016-8615
  • CVE-2016-8616
  • CVE-2016-8617
  • CVE-2016-8618
  • CVE-2016-8619
  • CVE-2016-8620
  • CVE-2016-8621
  • CVE-2016-8622
  • CVE-2016-8623
  • CVE-2016-8624
  • CVE-2016-9586
  • CVE-2017-1000100
  • CVE-2017-1000101
  • CVE-2017-7407

openssl:

  • CVE-2016-2105
  • CVE-2016-2106
  • CVE-2016-2107
  • CVE-2016-2108
  • CVE-2016-2109
  • CVE-2016-2177
  • CVE-2016-2178
  • CVE-2016-2179
  • CVE-2016-2180
  • CVE-2016-2181
  • CVE-2016-2182
  • CVE-2016-2183
  • CVE-2016-6302
  • CVE-2016-6303
  • CVE-2016-6304
  • CVE-2016-6306
  • CVE-2016-7056
  • CVE-2016-8610
  • CVE-2017-3731

cracklib:

  • CVE-2016-6318

pcre:

  • CVE-2014-8964
  • CVE-2015-2325
  • CVE-2015-2327
  • CVE-2015-2328
  • CVE-2015-3210
  • CVE-2015-3217
  • CVE-2015-5073
  • CVE-2015-8380
  • CVE-2015-8381
  • CVE-2015-8382
  • CVE-2015-8383
  • CVE-2015-8384
  • CVE-2015-8385
  • CVE-2015-8386
  • CVE-2015-8387
  • CVE-2015-8388
  • CVE-2015-8389
  • CVE-2015-8390
  • CVE-2015-8391
  • CVE-2015-8392
  • CVE-2015-8393
  • CVE-2015-8394
  • CVE-2015-8395
  • CVE-2016-1283
  • CVE-2016-3191

appamor:

  • CVE-2017-6507

bash:

  • CVE-2014-6277
  • CVE-2014-6278
  • CVE-2016-0634
  • CVE-2016-7543

cpio:

  • CVE-2016-2037

glibc:

  • CVE-2016-1234
  • CVE-2016-3075
  • CVE-2016-3706
  • CVE-2016-4429
  • CVE-2017-1000366

perl:

  • CVE-2015-8853
  • CVE-2016-1238
  • CVE-2016-2381
  • CVE-2016-6185

libssh2_org:

  • CVE-2016-0787

util-linux:

  • CVE-2016-5011
  • CVE-2017-2616

ncurses:

  • CVE-2017-10684
  • CVE-2017-10685
  • CVE-2017-11112
  • CVE-2017-11113

libksba:

  • CVE-2016-4574
  • CVE-2016-4579

libxml2:

  • CVE-2014-0191
  • CVE-2015-8806
  • CVE-2016-1762
  • CVE-2016-1833
  • CVE-2016-1834
  • CVE-2016-1835
  • CVE-2016-1837
  • CVE-2016-1838
  • CVE-2016-1839
  • CVE-2016-1840
  • CVE-2016-2073
  • CVE-2016-3627
  • CVE-2016-3705
  • CVE-2016-4447
  • CVE-2016-4448
  • CVE-2016-4449
  • CVE-2016-4483
  • CVE-2016-4658
  • CVE-2016-9318
  • CVE-2016-9597
  • CVE-2017-9047
  • CVE-2017-9048
  • CVE-2017-9049
  • CVE-2017-9050

libgcrypt:

  • CVE-2015-7511
  • CVE-2016-6313
  • CVE-2017-7526

update-alternatives:

  • CVE-2015-0860

systemd:

  • CVE-2014-9770
  • CVE-2015-8842
  • CVE-2016-7796

dbus-1:

  • CVE-2014-7824
  • CVE-2015-0245

Finally, the following packages received non-security fixes:

  • augeas
  • bzip2
  • ca-certificates-mozilla
  • coreutils
  • cryptsetup
  • cyrus-sasl
  • dirmngr
  • e2fsprogs
  • findutils
  • gpg2
  • insserv-compat
  • kmod
  • libcap
  • libsolv
  • libzypp
  • lua51
  • lvm2
  • netcfg
  • p11-kit
  • permissions
  • procps
  • rpm
  • sed
  • sg3_utils
  • shadow
  • zypper
Record
SUSE-SU-2017:2700-1
Updated
2026-11-02
OSVSUSE-SU-2020:0497-1 No score

Security update for python3

This update for python3 fixes the following issues:

Update to 3.4.10 (jsc#SLE-9427, bsc#1159208) from 3.4.6:

Security issues fixed:

  • Update expat copy from 2.1.1 to 2.2.0 to fix the following issues: CVE-2012-0876, CVE-2016-0718, CVE-2016-4472, CVE-2017-9233, CVE-2016-9063
  • CVE-2017-1000158: Fix an integer overflow in thePyString_DecodeEscape function in stringobject.c, resulting in heap-based bufferoverflow (bsc#1068664).
Record
SUSE-SU-2020:0497-1
Updated
2026-11-02
OSVUSN-3356-1 No score

expat vulnerability

It was discovered that Expat incorrectly handled certain external entities. A remote attacker could possibly use this issue to cause Expat to hang, resulting in a denial of service.

Record
USN-3356-1
Updated
2026-11-02
OSVUSN-4825-1 No score

coin3 vulnerability

USN-3356-1 fix a vulnerability in Expat. This update provides the corresponding update for Coin3D for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Record
USN-4825-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
expat
Alpine:v3.10
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.11
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.12
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.13
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.14
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.15
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.16
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.17
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.18
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.19
 before 2.2.0-r1
2.2.0-r1
Show 117 moreShow less
Affected packages
PackageAffectedFixed
expat
Alpine:v3.20
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.21
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.22
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.23
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.24
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.4
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.5
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.6
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.7
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.8
 before 2.2.0-r1
2.2.0-r1
expat
Alpine:v3.9
 before 2.2.0-r1
2.2.0-r1
expat
TuxCare:CentOS:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els1
2.1.0-15.0.7.el7_9.tuxcare.els1
expat-devel
TuxCare:CentOS:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els1
2.1.0-15.0.7.el7_9.tuxcare.els1
expat-static
TuxCare:CentOS:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els1
2.1.0-15.0.7.el7_9.tuxcare.els1
expat
TuxCare:OracleLinux:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els1
2.1.0-15.0.7.el7_9.tuxcare.els1
expat-devel
TuxCare:OracleLinux:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els1
2.1.0-15.0.7.el7_9.tuxcare.els1
expat-static
TuxCare:OracleLinux:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els1
2.1.0-15.0.7.el7_9.tuxcare.els1
expat
TuxCare:RHEL:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els1
2.1.0-15.0.7.el7_9.tuxcare.els1
expat-devel
TuxCare:RHEL:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els1
2.1.0-15.0.7.el7_9.tuxcare.els1
expat-static
TuxCare:RHEL:7
 before 2.1.0-15.0.7.el7_9.tuxcare.els1
2.1.0-15.0.7.el7_9.tuxcare.els1
expat
TuxCare:CentOS:6
 before 2.0.1-13.el6_8.tuxcare.els8
2.0.1-13.el6_8.tuxcare.els8
expat-devel
TuxCare:CentOS:6
 before 2.0.1-13.el6_8.tuxcare.els8
2.0.1-13.el6_8.tuxcare.els8
expat
TuxCare:OracleLinux:6
 before 2.0.1-13.el6_8.tuxcare.els8
2.0.1-13.el6_8.tuxcare.els8
expat-devel
TuxCare:OracleLinux:6
 before 2.0.1-13.el6_8.tuxcare.els8
2.0.1-13.el6_8.tuxcare.els8
expat
Debian:12
 before 2.2.1-1
2.2.1-1
expat
Debian:13
 before 2.2.1-1
2.2.1-1
expat
Debian:14
 before 2.2.1-1
2.2.1-1
libxmltok
Debian:12
 All versions, plus listed versions
1.2-41.2-4.11.2-4.1~exp11.2-4.2
 None known
expat
Debian:7
 before 2.1.0-1+deb7u5, plus listed versions
2.1.0-12.1.0-1+deb7u12.1.0-1+deb7u22.1.0-1+deb7u32.1.0-1+deb7u4
2.1.0-1+deb7u5
expat
Debian:8
 before 2.1.0-6+deb8u4, plus listed versions
2.1.0-62.1.0-6+deb8u12.1.0-6+deb8u22.1.0-6+deb8u32.1.0-6+deb8u3~kbsd8u1
2.1.0-6+deb8u4
expat
Debian:9
 before 2.2.0-2+deb9u1, plus listed versions
2.2.0-2
2.2.0-2+deb9u1
expat
Mageia:5
 before 2.1.0-9.5.mga5
2.1.0-9.5.mga5
expat
SUSE:Linux Enterprise Desktop 12 SP2
 before 2.1.0-21.3.1
2.1.0-21.3.1
expat
SUSE:Linux Enterprise Desktop 12 SP3
 before 2.1.0-21.3.1
2.1.0-21.3.1
expat
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
 before 2.1.0-21.3.1
2.1.0-21.3.1
expat
SUSE:Linux Enterprise Software Development Kit 12 SP2
 before 2.1.0-21.3.1
2.1.0-21.3.1
expat
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 2.1.0-21.3.1
2.1.0-21.3.1
expat
SUSE:Linux Enterprise Server 12 SP2
 before 2.1.0-21.3.1
2.1.0-21.3.1
expat
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 2.1.0-21.3.1
2.1.0-21.3.1
expat
SUSE:Linux Enterprise Server 12 SP3
 before 2.1.0-21.3.1
2.1.0-21.3.1
expat
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 2.1.0-21.3.1
2.1.0-21.3.1
expat
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 2.0.1-88.42.3.2
2.0.1-88.42.3.2
expat
SUSE:Linux Enterprise Server 11 SP4
 before 2.0.1-88.42.3.2
2.0.1-88.42.3.2
expat
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 2.0.1-88.42.3.2
2.0.1-88.42.3.2
expat
SUSE:Studio Onsite 1.3
 before 2.0.1-88.42.3.2
2.0.1-88.42.3.2
python3
SUSE:HPE Helion OpenStack 8
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:HPE Helion OpenStack 8
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:OpenStack Cloud 7
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:OpenStack Cloud 7
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:OpenStack Cloud 8
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:OpenStack Cloud 8
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:OpenStack Cloud Crowbar 8
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:OpenStack Cloud Crowbar 8
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Desktop 12 SP4
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Desktop 12 SP4
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP4
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP4
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP5
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP5
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Enterprise Storage 5
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Enterprise Storage 5
 before 3.4.10-25.39.2
3.4.10-25.39.2
expat
Ubuntu:14.04:LTS
 before 2.1.0-4ubuntu1.4, plus listed versions
2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.12.1.0-4ubuntu1.22.1.0-4ubuntu1.3
2.1.0-4ubuntu1.4
coin3
Ubuntu:Pro:14.04:LTS
 before 3.1.4~abc9f50-4ubuntu2+esm1, plus listed versions
3.1.4~abc9f50-33.1.4~abc9f50-43.1.4~abc9f50-4ubuntu2
3.1.4~abc9f50-4ubuntu2+esm1
vnc4
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37ubuntu54.1.1+xorg4.3.0-37ubuntu5.0.14.1.1+xorg4.3.0-37ubuntu5.0.24.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
 None known
expat
Ubuntu:16.04:LTS
 before 2.1.0-7ubuntu0.16.04.3, plus listed versions
2.1.0-72.1.0-7ubuntu0.16.04.12.1.0-7ubuntu0.16.04.2
2.1.0-7ubuntu0.16.04.3
coin3
Ubuntu:Pro:16.04:LTS
 before 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1, plus listed versions
3.1.4~abc9f50+dfsg1-1
3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1
cableswig
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.1.0+git20150808-10.1.0+git20150808-20.1.0+git20150808-2ubuntu0.1~esm1
 None known
insighttoolkit4
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.8.1-1ubuntu34.8.1-1ubuntu44.8.2-3.1ubuntu14.9.0-3ubuntu24.9.0-4ubuntu14.9.0-4ubuntu1.1
 None known
matanza
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.13+ds1-5
 None known
swish-e
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.4.7-42.4.7-4build12.4.7-4ubuntu0.1~esm1
 None known
vnc4
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu24.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
 None known
coin3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-23.1.4~abc9f50+dfsg2-13.1.4~abc9f50+dfsg3-13.1.4~abc9f50+dfsg3-23.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
 None known
matanza
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.13+ds1-5build10.13+ds1-6
 None known
swish-e
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.4.7-5ubuntu12.4.7-5ubuntu1+esm1
 None known
vnc4
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu2
 None known
matanza
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.13+ds1-60.13+ds2-1
 None known
swish-e
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.4.7-6build12.4.7-6build22.4.7-6ubuntu0.1~esm1
 None known
matanza
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.13+ds2-1
 None known
swish-e
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.4.7-6build32.4.7-6.12.4.7-6.1build12.4.7-6.1ubuntu0.1~esm1
 None known
matanza
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.13+ds2-10.13+ds2-1build10.13+ds2-1build2
 None known
swish-e
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.4.7-6.22.4.7-6.2build12.4.7-6.2build22.4.7-6.2build32.4.7-6.2ubuntu0.1~esm1
 None known
matanza
Ubuntu:25.10
 All versions, plus listed versions
0.13+ds2-2
 None known
sitecopy
Ubuntu:25.10
 All versions, plus listed versions
1:0.16.6-161:0.16.6-16build1
 None known
swish-e
Ubuntu:25.10
 All versions, plus listed versions
2.4.7-6.32.4.7-6.3build12.4.7-7
 None known
matanza
Ubuntu:26.10
 All versions, plus listed versions
0.13+ds2-2build1
 None known
sitecopy
Ubuntu:26.10
 All versions, plus listed versions
1:0.16.6-16build1
 None known
swish-e
Ubuntu:26.10
 All versions, plus listed versions
2.4.7-7.12.4.7-7.22.4.7-7.2build1
 None known
matanza
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.13+ds2-20.13+ds2-2build1
 None known
sitecopy
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:0.16.6-16build1
 None known
swish-e
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.4.7-72.4.7-7.12.4.7-7.1ubuntu0.1~esm1
 None known
expat
openSUSE:Tumbleweed
 before 2.4.1-1.2
2.4.1-1.2

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-9233 is a high vulnerability (CVSS 7.5) in Libexpat Project Libexpat, published June 18, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.74%, the 95th percentile. Fixed in expat 2.2.0-r1.

References

Show 190 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open