Every CVE Search/ Get API key

CVE-2016-0718

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute...

9.8 CriticalFix available

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

13.3%Up 10.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

Record
CVE-2016-0718
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

Record
CVE-2016-0718
Updated
2026-11-02
EUVDEUVD-2016-0749 No score

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

Record
EUVD-2016-0749
Updated
2026-11-02
GitHub AdvisoriesGHSA-3f8j-8ww3-q7v6 9.8

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute...

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

Record
GHSA-3f8j-8ww3-q7v6
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVALPINE-CVE-2016-0718 9.8

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

Record
ALPINE-CVE-2016-0718
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

Record
CVE-2016-0718
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
Show 19 moreShow less
OSVDEBIAN-CVE-2016-0718 9.8

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

Record
DEBIAN-CVE-2016-0718
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2016-0718 9.8

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

Record
UBUNTU-CVE-2016-0718
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2016-0193 No score

Updated expat packages fix security vulnerability

Gustavo Grieco discovered that Expat does not properly handle certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. A remote attacker can take advantage of this flaw to cause an application using the Expat library to crash, or potentially, to execute arbitrary code with the privileges of the user running the application (CVE-2016-0718).

Record
MGASA-2016-0193
Updated
2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score

MozillaFirefox-50.1.0-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10071-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10077-1 No score

expat-2.2.0-3.1 on GA media

These are all security issues fixed in the expat-2.2.0-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10077-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVPSF-2016-2 No score

Expat 2.2 (Expat bug #537)

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.

Record
PSF-2016-2
Updated
2026-11-02
OSVSUSE-SU-2016:1508-1 No score

Security update for expat

This update for expat fixes the following issues:

Security issue fixed:

  • CVE-2016-0718: Fix Expat XML parser that mishandles certain kinds of malformed input documents. (bsc#979441)
  • CVE-2015-1283: Fix multiple integer overflows. (bnc#980391)
Record
SUSE-SU-2016:1508-1
Updated
2026-11-02
OSVSUSE-SU-2016:1512-1 No score

Security update for expat

This update for expat fixes the following issues:

Security issue fixed:

  • CVE-2016-0718: Fix Expat XML parser that mishandles certain kinds of malformed input documents. (bsc#979441)
  • CVE-2015-1283: Fix multiple integer overflows. (bnc#980391)
Record
SUSE-SU-2016:1512-1
Updated
2026-11-02
OSVSUSE-SU-2017:2699-1 No score

Security update for SLES 12 Docker image

The SUSE Linux Enterprise Server 12 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

  • Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
  • Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 are now included in the base image. A package/CVE cross-reference is available below.

pam:

  • CVE-2015-3238

libtasn1:

  • CVE-2015-3622
  • CVE-2016-4008

libidn:

  • CVE-2015-2059
  • CVE-2015-8948
  • CVE-2016-6261
  • CVE-2016-6262
  • CVE-2016-6263

zlib:

  • CVE-2016-9840
  • CVE-2016-9841
  • CVE-2016-9842
  • CVE-2016-9843

curl:

  • CVE-2016-5419
  • CVE-2016-5420
  • CVE-2016-5421
  • CVE-2016-7141
  • CVE-2016-7167
  • CVE-2016-8615
  • CVE-2016-8616
  • CVE-2016-8617
  • CVE-2016-8618
  • CVE-2016-8619
  • CVE-2016-8620
  • CVE-2016-8621
  • CVE-2016-8622
  • CVE-2016-8623
  • CVE-2016-8624
  • CVE-2016-9586
  • CVE-2017-1000100
  • CVE-2017-1000101
  • CVE-2017-7407

openssl:

  • CVE-2016-2105
  • CVE-2016-2106
  • CVE-2016-2107
  • CVE-2016-2108
  • CVE-2016-2109
  • CVE-2016-2177
  • CVE-2016-2178
  • CVE-2016-2179
  • CVE-2016-2180
  • CVE-2016-2181
  • CVE-2016-2182
  • CVE-2016-2183
  • CVE-2016-6302
  • CVE-2016-6303
  • CVE-2016-6304
  • CVE-2016-6306

libxml2:

  • CVE-2014-0191
  • CVE-2015-8806
  • CVE-2016-1762
  • CVE-2016-1833
  • CVE-2016-1834
  • CVE-2016-1835
  • CVE-2016-1837
  • CVE-2016-1838
  • CVE-2016-1839
  • CVE-2016-1840
  • CVE-2016-2073
  • CVE-2016-3627
  • CVE-2016-3705
  • CVE-2016-4447
  • CVE-2016-4448
  • CVE-2016-4449
  • CVE-2016-4483
  • CVE-2016-4658
  • CVE-2016-9318
  • CVE-2016-9597
  • CVE-2017-9047
  • CVE-2017-9048
  • CVE-2017-9049
  • CVE-2017-9050

util-linux:

  • CVE-2015-5218
  • CVE-2016-5011
  • CVE-2017-2616

cracklib:

  • CVE-2016-6318

systemd:

  • CVE-2014-9770
  • CVE-2015-8842
  • CVE-2016-7796

pcre:

  • CVE-2014-8964
  • CVE-2015-2325
  • CVE-2015-2327
  • CVE-2015-2328
  • CVE-2015-3210
  • CVE-2015-3217
  • CVE-2015-5073
  • CVE-2015-8380
  • CVE-2015-8381
  • CVE-2015-8382
  • CVE-2015-8383
  • CVE-2015-8384
  • CVE-2015-8385
  • CVE-2015-8386
  • CVE-2015-8387
  • CVE-2015-8388
  • CVE-2015-8389
  • CVE-2015-8390
  • CVE-2015-8391
  • CVE-2015-8392
  • CVE-2015-8393
  • CVE-2015-8394
  • CVE-2015-8395
  • CVE-2016-1283
  • CVE-2016-3191

appamor:

  • CVE-2017-6507

bash:

  • CVE-2014-6277
  • CVE-2014-6278
  • CVE-2016-0634
  • CVE-2016-7543

cpio:

  • CVE-2016-2037

glibc:

  • CVE-2016-1234
  • CVE-2016-3075
  • CVE-2016-3706
  • CVE-2016-4429
  • CVE-2017-1000366

perl:

  • CVE-2015-8853
  • CVE-2016-1238
  • CVE-2016-2381
  • CVE-2016-6185

libssh2_org:

  • CVE-2016-0787

expat:

  • CVE-2012-6702
  • CVE-2015-1283
  • CVE-2016-0718
  • CVE-2016-5300
  • CVE-2016-9063
  • CVE-2017-9233

ncurses:

  • CVE-2017-10684
  • CVE-2017-10685
  • CVE-2017-11112
  • CVE-2017-11113

libksba:

  • CVE-2016-4574
  • CVE-2016-4579

libgcrypt:

  • CVE-2015-7511
  • CVE-2016-6313
  • CVE-2017-7526

dbus-1:

  • CVE-2014-7824
  • CVE-2015-0245

Finally, the following packages received non-security fixes:

  • augeas
  • bzip2
  • ca-certificates-mozilla
  • coreutils
  • cryptsetup
  • cyrus-sasl
  • dirmngr
  • e2fsprogs
  • findutils
  • gpg2
  • insserv-compat
  • kmod
  • libcap
  • libsolv
  • libzypp
  • openldap2
  • p11-kit
  • permissions
  • procps
  • rpm
  • sed
  • shadow
  • zypper
Record
SUSE-SU-2017:2699-1
Updated
2026-11-02
OSVSUSE-SU-2017:2700-1 No score

Security update for SLES 12-SP1 Docker image

The SUSE Linux Enterprise Server 12 SP1 container image has been updated to include security and stability fixes.

The following issues related to building of the container images have been fixed:

  • Included krb5 package to avoid the inclusion of krb5-mini which gets selected as a dependency by the Build Service solver. (bsc#1056193)
  • Do not install recommended packages when building container images. (bsc#975726)

A number of security issues that have been already fixed by updates released for SUSE Linux Enterprise Server 12 SP1 are now included in the base image. A package/CVE cross-reference is available below.

pam:

  • CVE-2015-3238

libtasn1:

  • CVE-2015-3622
  • CVE-2016-4008

expat:

expat:

  • CVE-2012-6702
  • CVE-2015-1283
  • CVE-2016-0718
  • CVE-2016-5300
  • CVE-2016-9063
  • CVE-2017-9233

libidn:

  • CVE-2015-2059
  • CVE-2015-8948
  • CVE-2016-6261
  • CVE-2016-6262
  • CVE-2016-6263

zlib:

  • CVE-2016-9840
  • CVE-2016-9841
  • CVE-2016-9842
  • CVE-2016-9843

curl:

  • CVE-2016-5419
  • CVE-2016-5420
  • CVE-2016-5421
  • CVE-2016-7141
  • CVE-2016-7167
  • CVE-2016-8615
  • CVE-2016-8616
  • CVE-2016-8617
  • CVE-2016-8618
  • CVE-2016-8619
  • CVE-2016-8620
  • CVE-2016-8621
  • CVE-2016-8622
  • CVE-2016-8623
  • CVE-2016-8624
  • CVE-2016-9586
  • CVE-2017-1000100
  • CVE-2017-1000101
  • CVE-2017-7407

openssl:

  • CVE-2016-2105
  • CVE-2016-2106
  • CVE-2016-2107
  • CVE-2016-2108
  • CVE-2016-2109
  • CVE-2016-2177
  • CVE-2016-2178
  • CVE-2016-2179
  • CVE-2016-2180
  • CVE-2016-2181
  • CVE-2016-2182
  • CVE-2016-2183
  • CVE-2016-6302
  • CVE-2016-6303
  • CVE-2016-6304
  • CVE-2016-6306
  • CVE-2016-7056
  • CVE-2016-8610
  • CVE-2017-3731

cracklib:

  • CVE-2016-6318

pcre:

  • CVE-2014-8964
  • CVE-2015-2325
  • CVE-2015-2327
  • CVE-2015-2328
  • CVE-2015-3210
  • CVE-2015-3217
  • CVE-2015-5073
  • CVE-2015-8380
  • CVE-2015-8381
  • CVE-2015-8382
  • CVE-2015-8383
  • CVE-2015-8384
  • CVE-2015-8385
  • CVE-2015-8386
  • CVE-2015-8387
  • CVE-2015-8388
  • CVE-2015-8389
  • CVE-2015-8390
  • CVE-2015-8391
  • CVE-2015-8392
  • CVE-2015-8393
  • CVE-2015-8394
  • CVE-2015-8395
  • CVE-2016-1283
  • CVE-2016-3191

appamor:

  • CVE-2017-6507

bash:

  • CVE-2014-6277
  • CVE-2014-6278
  • CVE-2016-0634
  • CVE-2016-7543

cpio:

  • CVE-2016-2037

glibc:

  • CVE-2016-1234
  • CVE-2016-3075
  • CVE-2016-3706
  • CVE-2016-4429
  • CVE-2017-1000366

perl:

  • CVE-2015-8853
  • CVE-2016-1238
  • CVE-2016-2381
  • CVE-2016-6185

libssh2_org:

  • CVE-2016-0787

util-linux:

  • CVE-2016-5011
  • CVE-2017-2616

ncurses:

  • CVE-2017-10684
  • CVE-2017-10685
  • CVE-2017-11112
  • CVE-2017-11113

libksba:

  • CVE-2016-4574
  • CVE-2016-4579

libxml2:

  • CVE-2014-0191
  • CVE-2015-8806
  • CVE-2016-1762
  • CVE-2016-1833
  • CVE-2016-1834
  • CVE-2016-1835
  • CVE-2016-1837
  • CVE-2016-1838
  • CVE-2016-1839
  • CVE-2016-1840
  • CVE-2016-2073
  • CVE-2016-3627
  • CVE-2016-3705
  • CVE-2016-4447
  • CVE-2016-4448
  • CVE-2016-4449
  • CVE-2016-4483
  • CVE-2016-4658
  • CVE-2016-9318
  • CVE-2016-9597
  • CVE-2017-9047
  • CVE-2017-9048
  • CVE-2017-9049
  • CVE-2017-9050

libgcrypt:

  • CVE-2015-7511
  • CVE-2016-6313
  • CVE-2017-7526

update-alternatives:

  • CVE-2015-0860

systemd:

  • CVE-2014-9770
  • CVE-2015-8842
  • CVE-2016-7796

dbus-1:

  • CVE-2014-7824
  • CVE-2015-0245

Finally, the following packages received non-security fixes:

  • augeas
  • bzip2
  • ca-certificates-mozilla
  • coreutils
  • cryptsetup
  • cyrus-sasl
  • dirmngr
  • e2fsprogs
  • findutils
  • gpg2
  • insserv-compat
  • kmod
  • libcap
  • libsolv
  • libzypp
  • lua51
  • lvm2
  • netcfg
  • p11-kit
  • permissions
  • procps
  • rpm
  • sed
  • sg3_utils
  • shadow
  • zypper
Record
SUSE-SU-2017:2700-1
Updated
2026-11-02
OSVSUSE-SU-2020:0497-1 No score

Security update for python3

This update for python3 fixes the following issues:

Update to 3.4.10 (jsc#SLE-9427, bsc#1159208) from 3.4.6:

Security issues fixed:

  • Update expat copy from 2.1.1 to 2.2.0 to fix the following issues: CVE-2012-0876, CVE-2016-0718, CVE-2016-4472, CVE-2017-9233, CVE-2016-9063
  • CVE-2017-1000158: Fix an integer overflow in thePyString_DecodeEscape function in stringobject.c, resulting in heap-based bufferoverflow (bsc#1068664).
Record
SUSE-SU-2020:0497-1
Updated
2026-11-02
OSVSUSE-SU-2026:24323-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
  • CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
  • CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
  • CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
  • CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
  • CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
  • CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
  • CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
  • CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
  • CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
  • CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
  • CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
  • CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
  • CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
  • CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
  • CMake: only add /source-charset:utf-8 when /utf-8 is not present
  • lib: resolve undefined behavior from overshifting a signed int
  • lib: support read-only hash table lookup with non-zero-terminated keys
  • lib: use a C99 bool for ENTITY.open
  • version info bumped from 13:3:12 to 13:4:12
  • fix support for 2+ GiB documents (regression from 2.8.2)
  • reject empty version in the XML declaration
  • fix printf format for AIX
  • CMake|AIX: enable EXPAT_DEV_URANDOM by default
  • version info bumped from 13:2:12 to 13:3:12
  • Existing API function XML_SetHashSalt is now deprecated
  • because of its limitations, and its use should be
  • considered a vulnerability. Please either use the new API
  • function XML_SetHashSalt16Bytes (with known-high-quality
  • entropy input only!) instead, or leave the derivation of
  • a 16-bytes hash salt from high quality entropy to Expat's
  • internal machinery (by not calling either of the two
  • XML_SetHashSalt* functions).
  • xmlwf: Fix a memory leak
  • WASI: Fix format specifiers for 32bit WASI SDK
  • Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2)
  • Fix a class of…
Record
SUSE-SU-2026:24323-1
Updated
2026-11-02
OSVSUSE-SU-2026:4615-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
  • CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
  • CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
  • CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
  • CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
  • CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
  • CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
  • CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
  • CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
  • CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
  • CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
  • CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
  • CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
  • CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
  • CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
  • CMake: only add /source-charset:utf-8 when /utf-8 is not present
  • lib: resolve undefined behavior from overshifting a signed int
  • lib: support read-only hash table lookup with non-zero-terminated keys
  • lib: use a C99 bool for ENTITY.open
  • version info bumped from 13:3:12 to 13:4:12
  • fix support for 2+ GiB documents (regression from 2.8.2)
  • reject empty version in the XML declaration
  • fix printf format for AIX
  • CMake|AIX: enable EXPAT_DEV_URANDOM by default
  • version info bumped from 13:2:12 to 13:3:12
  • Existing API function XML_SetHashSalt is now deprecated
  • because of its limitations, and its use should be
  • considered a vulnerability. Please either use the new API
  • function XML_SetHashSalt16Bytes (with known-high-quality
  • entropy input only!) instead, or leave the derivation of
  • a 16-bytes hash salt from high quality entropy to Expat's
  • internal machinery (by not calling either of the two
  • XML_SetHashSalt* functions).
  • xmlwf: Fix a memory leak
  • WASI: Fix format specifiers for 32bit WASI SDK
  • Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2)
  • Fix a class of…
Record
SUSE-SU-2026:4615-1
Updated
2026-11-02
OSVSUSE-SU-2026:4623-1 No score

Security update for expat

This update for expat fixes the following issues:

  • CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).
  • CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).
  • CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).
  • CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726).
  • CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).
  • CVE-2026-32778: NULL pointer dereference in setContext on retry after an out-of-memory condition (bsc#1259729).
  • CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
  • CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).
  • CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631).
  • CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
  • CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).
  • CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).
  • CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732).
  • CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
  • CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
  • CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).
  • CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859).
  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
  • CMake: only add /source-charset:utf-8 when /utf-8 is not present
  • lib: resolve undefined behavior from overshifting a signed int
  • lib: support read-only hash table lookup with non-zero-terminated keys
  • lib: use a C99 bool for ENTITY.open
  • version info bumped from 13:3:12 to 13:4:12
  • fix support for 2+ GiB documents (regression from 2.8.2)
  • reject empty version in the XML declaration
  • fix printf format for AIX
  • CMake|AIX: enable EXPAT_DEV_URANDOM by default
  • version info bumped from 13:2:12 to 13:3:12
  • Existing API function XML_SetHashSalt is now deprecated
  • because of its limitations, and its use should be
  • considered a vulnerability. Please either use the new API
  • function XML_SetHashSalt16Bytes (with known-high-quality
  • entropy input only!) instead, or leave the derivation of
  • a 16-bytes hash salt from high quality entropy to Expat's
  • internal machinery (by not calling either of the two
  • XML_SetHashSalt* functions).
  • xmlwf: Fix a memory leak
  • WASI: Fix format specifiers for 32bit WASI SDK
  • Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2)
  • Fix a class of…
Record
SUSE-SU-2026:4623-1
Updated
2026-11-02
OSVUSN-2983-1 No score

expat vulnerability

Gustavo Grieco discovered that Expat incorrectly handled malformed XML data. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2016-0718)

Record
USN-2983-1
Updated
2026-11-02
OSVUSN-3044-1 No score

firefox vulnerabilities

Gustavo Grieco discovered an out-of-bounds read during XML parsing in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or obtain sensitive information. (CVE-2016-0718)

Toni Huttunen discovered that once a favicon is requested from a site, the remote server can keep the network connection open even after the page is closed. A remote attacked could potentially exploit this to track users, resulting in information disclosure. (CVE-2016-2830)

Christian Holler, Tyson Smith, Boris Zbarsky, Byron Campen, Julian Seward, Carsten Book, Gary Kwong, Jesse Ruderman, Andrew McCreight, and Phil Ringnalda discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2835, CVE-2016-2836)

A buffer overflow was discovered in the ClearKey Content Decryption Module (CDM) during video playback. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via plugin process crash, or, in combination with another vulnerability to escape the GMP sandbox, execute arbitrary code. (CVE-2016-2837)

Atte Kettunen discovered a buffer overflow when rendering SVG content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2838)

Bert Massop discovered a crash in Cairo with version 0.10 of FFmpeg. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code. (CVE-2016-2839)

Catalin Dumitru discovered that URLs of resources loaded after a navigation start could be leaked to the following page via the Resource Timing API. An attacker could potentially exploit this to obtain sensitive information. (CVE-2016-5250)

Firas Salem discovered an issue with non-ASCII and emoji characters in data: URLs. An attacker could potentially exploit this to spoof the addressbar contents. (CVE-2016-5251)

Georg Koppen discovered a stack buffer underflow during 2D graphics rendering in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5252)

Abhishek Arya discovered a use-after-free when the alt key is used with top-level menus. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5254)

Jukka Jylänki discovered a crash during garbage collection. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code. (CVE-2016-5255)

Looben Yang discovered a use-after-free in WebRTC. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5258)

Looben Yang discovered a use-after-free when working with nested sync events in service workers. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5259)

Mike Kaply discovered that plain-text passwords can be stored in session restore if an input field type is changed from "password" to "text" during a session, leading to information disclosure. (CVE-2016-5260)

Samuel Groß discovered an integer overflow in WebSockets during data buffering in some…

Record
USN-3044-1
Updated
2026-11-02
OSVUSN-5455-1 No score

libxmltok vulnerabilities

Tim Boddy, Gustavo Grieco and others discovered that Expat, that is integrated in xmltok library, incorrectly handled certain files. An attacker could possibly use these issues to cause a denial of service, or possibly execute arbitrary code. These issues were only addressed in Ubuntu 16.04 ESM. (CVE-2012-1148, CVE-2015-1283, CVE-2016-0718, CVE-2016-4472, CVE-2018-20843, CVE-2019-15903, CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824, CVE-2022-22825, CVE-2022-22826, CVE-2022-22827)

It was discovered that Expat, that is integrated in xmltok library, incorrectly handled encoding validation of certain files. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2022-25235)

It was discovered that Expat, that is integrated in xmltok library, incorrectly handled namespace URIs of certain files. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2022-25236)

Record
USN-5455-1
Updated
2026-11-02
OSVUSN-7199-1 No score

libxmltok vulnerabilities

It was discovered that Expat, contained within the xmltok library, incorrectly handled malformed XML data. If a user or application were tricked into opening a crafted XML file, an attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2015-1283, CVE-2016-0718, CVE-2016-4472, CVE-2019-15903)

It was discovered that Expat, contained within the xmltok library, incorrectly handled XML data containing a large number of colons, which could lead to excessive resource consumption. If a user or application were tricked into opening a crafted XML file, an attacker could possibly use this issue to cause a denial of service. (CVE-2018-20843)

It was discovered that Expat, contained within the xmltok library, incorrectly handled certain input, which could lead to an integer overflow. If a user or application were tricked into opening a crafted XML file, an attacker could possibly use this issue to cause a denial of service. (CVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824, CVE-2022-22825, CVE-2022-22826, CVE-2022-22827)

Record
USN-7199-1
Updated
2026-11-02

Affected products

Show 2 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
expat
Alpine:v3.4
 before 2.1.1-r1
2.1.1-r1
expat
Debian:12
 before 2.1.1-2
2.1.1-2
expat
Debian:13
 before 2.1.1-2
2.1.1-2
expat
Debian:14
 before 2.1.1-2
2.1.1-2
libxmltok
Debian:12
 All versions, plus listed versions
1.2-41.2-4.11.2-4.1~exp11.2-4.2
 None known
expat
Debian:7
 before 2.1.0-1+deb7u3, plus listed versions
2.1.0-12.1.0-1+deb7u12.1.0-1+deb7u2
2.1.0-1+deb7u3
expat
Debian:8
 before 2.1.0-6+deb8u2, plus listed versions
2.1.0-62.1.0-6+deb8u1
2.1.0-6+deb8u2
expat
Mageia:5
 before 2.1.0-9.2.mga5
2.1.0-9.2.mga5
expat
Red Hat:enterprise_linux:6::client
 before 0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
expat-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
Show 162 moreShow less
Affected packages
PackageAffectedFixed
expat-devel
Red Hat:enterprise_linux:6::client
 before 0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
expat
Red Hat:enterprise_linux:6::computenode
 before 0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
expat-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
expat-devel
Red Hat:enterprise_linux:6::computenode
 before 0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
expat
Red Hat:enterprise_linux:6::server
 before 0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
expat-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
expat-devel
Red Hat:enterprise_linux:6::server
 before 0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
expat
Red Hat:enterprise_linux:6::workstation
 before 0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
expat-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
expat-devel
Red Hat:enterprise_linux:6::workstation
 before 0:2.0.1-13.el6_8
0:2.0.1-13.el6_8
expat
Red Hat:enterprise_linux:7::client
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat-devel
Red Hat:enterprise_linux:7::client
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat-static
Red Hat:enterprise_linux:7::client
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat
Red Hat:enterprise_linux:7::computenode
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat-devel
Red Hat:enterprise_linux:7::computenode
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat-static
Red Hat:enterprise_linux:7::computenode
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat
Red Hat:enterprise_linux:7::server
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat-devel
Red Hat:enterprise_linux:7::server
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat-static
Red Hat:enterprise_linux:7::server
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat
Red Hat:enterprise_linux:7::workstation
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat-devel
Red Hat:enterprise_linux:7::workstation
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat-static
Red Hat:enterprise_linux:7::workstation
 before 0:2.1.0-10.el7_3
0:2.1.0-10.el7_3
expat
SUSE:Linux Enterprise Desktop 12
 before 2.1.0-17.1
2.1.0-17.1
expat
SUSE:Linux Enterprise Desktop 12 SP1
 before 2.1.0-17.1
2.1.0-17.1
expat
SUSE:Linux Enterprise Software Development Kit 12
 before 2.1.0-17.1
2.1.0-17.1
expat
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 2.1.0-17.1
2.1.0-17.1
expat
SUSE:Linux Enterprise Server 12
 before 2.1.0-17.1
2.1.0-17.1
expat
SUSE:Linux Enterprise Server for SAP Applications 12
 before 2.1.0-17.1
2.1.0-17.1
expat
SUSE:Linux Enterprise Server 12 SP1
 before 2.1.0-17.1
2.1.0-17.1
expat
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 2.1.0-17.1
2.1.0-17.1
expat
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 2.0.1-88.38.1
2.0.1-88.38.1
expat
SUSE:Linux Enterprise Server 11 SP4
 before 2.0.1-88.38.1
2.0.1-88.38.1
expat
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 2.0.1-88.38.1
2.0.1-88.38.1
expat
SUSE:Studio Onsite 1.3
 before 2.0.1-88.38.1
2.0.1-88.38.1
python3
SUSE:HPE Helion OpenStack 8
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:HPE Helion OpenStack 8
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:OpenStack Cloud 7
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:OpenStack Cloud 7
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:OpenStack Cloud 8
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:OpenStack Cloud 8
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:OpenStack Cloud Crowbar 8
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:OpenStack Cloud Crowbar 8
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Desktop 12 SP4
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Desktop 12 SP4
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP4
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP4
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server 12 SP5
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server 12 SP5
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 3.4.10-25.39.2
3.4.10-25.39.2
python3
SUSE:Enterprise Storage 5
 before 3.4.10-25.39.3
3.4.10-25.39.3
python3-base
SUSE:Enterprise Storage 5
 before 3.4.10-25.39.2
3.4.10-25.39.2
expat
SUSE:Linux Micro 6.0
 before 2.8.5-159998.1.1
2.8.5-159998.1.1
expat
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 2.8.5-21.55.1
2.8.5-21.55.1
expat
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 2.8.5-21.55.1
2.8.5-21.55.1
expat
SUSE:Linux Enterprise Micro 5.3
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Micro 5.4
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Micro 5.5
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 2.8.5-150400.3.40.1
2.8.5-150400.3.40.1
expat
Ubuntu:14.04:LTS
 before 2.1.0-4ubuntu1.2, plus listed versions
2.1.0-42.1.0-4ubuntu12.1.0-4ubuntu1.1
2.1.0-4ubuntu1.2
firefox
Ubuntu:14.04:LTS
 before 48.0+build2-0ubuntu0.14.04.1, plus listed versions
24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1
Show 37 moreShow less
28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.136.0.4+build1-0ubuntu0.14.04.137.0+build2-0ubuntu0.14.04.137.0.1+build1-0ubuntu0.14.04.137.0.2+build1-0ubuntu0.14.04.138.0+build3-0ubuntu0.14.04.139.0+build5-0ubuntu0.14.04.139.0.3+build2-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.440.0.3+build1-0ubuntu0.14.04.141.0+build3-0ubuntu0.14.04.141.0.1+build2-0ubuntu0.14.04.141.0.2+build2-0ubuntu0.14.04.142.0+build2-0ubuntu0.14.04.143.0+build1-0ubuntu0.14.04.143.0.4+build3-0ubuntu0.14.04.144.0+build3-0ubuntu0.14.04.144.0.1+build2-0ubuntu0.14.04.144.0.2+build1-0ubuntu0.14.04.145.0+build2-0ubuntu0.14.04.145.0.1+build1-0ubuntu0.14.04.245.0.2+build1-0ubuntu0.14.04.146.0+build5-0ubuntu0.14.04.246.0.1+build1-0ubuntu0.14.04.347.0+build3-0ubuntu0.14.04.1
48.0+build2-0ubuntu0.14.04.1
coin3
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50-33.1.4~abc9f50-43.1.4~abc9f50-4ubuntu23.1.4~abc9f50-4ubuntu2+esm13.1.4~abc9f50-4ubuntu2+esm2
 None known
vnc4
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37ubuntu54.1.1+xorg4.3.0-37ubuntu5.0.14.1.1+xorg4.3.0-37ubuntu5.0.24.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
 None known
xmlrpc-c
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.16.33-3.2ubuntu31.33.06-0ubuntu11.33.06-0ubuntu1+esm1
 None known
expat
Ubuntu:16.04:LTS
 before 2.1.0-7ubuntu0.16.04.1, plus listed versions
2.1.0-7
2.1.0-7ubuntu0.16.04.1
firefox
Ubuntu:16.04:LTS
 before 48.0+build2-0ubuntu0.16.04.1, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 6 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.1
48.0+build2-0ubuntu0.16.04.1
libxmltok
Ubuntu:Pro:16.04:LTS
 before 1.2-3ubuntu0.16.04.1~esm2, plus listed versions
1.2-3build31.2-3ubuntu0.16.04.1~esm1
1.2-3ubuntu0.16.04.1~esm2
ayttm
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.6.3-3build10.6.3-3ubuntu0.1~esm1
 None known
cableswig
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.1.0+git20150808-10.1.0+git20150808-20.1.0+git20150808-2ubuntu0.1~esm1
 None known
cadaver
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.23.3-2ubuntu2
 None known
coin3
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm13.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
 None known
insighttoolkit
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.20.1+git20120521-63.20.1+git20120521-6build13.20.1+git20120521-6ubuntu0.1~esm1
 None known
matanza
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.13+ds1-5
 None known
swish-e
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.4.7-42.4.7-4build12.4.7-4ubuntu0.1~esm1
 None known
vnc4
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu24.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
 None known
xmlrpc-c
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.33.14-0.2ubuntu31.33.14-1ubuntu11.33.14-1ubuntu1+esm1
 None known
cadaver
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.23.3-2ubuntu3
 None known
coin3
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.1.4~abc9f50+dfsg1-23.1.4~abc9f50+dfsg2-13.1.4~abc9f50+dfsg3-13.1.4~abc9f50+dfsg3-23.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
 None known
libxmltok
Ubuntu:Pro:18.04:LTS
 before 1.2-4ubuntu0.18.04.1~esm4, plus listed versions
1.2-41.2-4ubuntu0.18.04.1~esm11.2-4ubuntu0.18.04.1~esm21.2-4ubuntu0.18.04.1~esm3
1.2-4ubuntu0.18.04.1~esm4
matanza
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.13+ds1-5build10.13+ds1-6
 None known
swish-e
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.4.7-5ubuntu12.4.7-5ubuntu1+esm1
 None known
vnc4
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.1.1+xorg4.3.0-37.3ubuntu2
 None known
xmlrpc-c
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.33.14-71.33.14-81.33.14-8build11.33.14-8ubuntu0.18.04.1~esm1
 None known
cadaver
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.23.3-2.1build1
 None known
coin3
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.0.0~CMake~6f54f1602475+ds1-34.0.0+ds-1build1
 None known
libxmltok
Ubuntu:Pro:20.04:LTS
 before 1.2-4ubuntu0.20.04.1~esm4, plus listed versions
1.2-41.2-4ubuntu0.20.04.1~esm11.2-4ubuntu0.20.04.1~esm21.2-4ubuntu0.20.04.1~esm3
1.2-4ubuntu0.20.04.1~esm4
matanza
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.13+ds1-60.13+ds2-1
 None known
swish-e
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.4.7-6build12.4.7-6build22.4.7-6ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.33.14-8build11.33.14-8build21.33.14-8ubuntu0.20.04.1~esm1
 None known
cadaver
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.23.3-2.1build1
 None known
coin3
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.0.0+ds-1build14.0.0+ds-2
 None known
matanza
Ubuntu:22.04:LTS
 All versions, plus listed versions
0.13+ds2-1
 None known
libxmltok
Ubuntu:Pro:22.04:LTS
 before 1.2-4ubuntu0.22.04.1~esm4, plus listed versions
1.2-41.2-4ubuntu0.22.04.1~esm11.2-4ubuntu0.22.04.1~esm21.2-4ubuntu0.22.04.1~esm3
1.2-4ubuntu0.22.04.1~esm4
swish-e
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.4.7-6build32.4.7-6.12.4.7-6.1build12.4.7-6.1ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.33.14-91.33.14-101.33.14-10ubuntu0.1~esm1
 None known
cadaver
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.24+dfsg-20.24+dfsg-30.24+dfsg-3build10.24+dfsg-3build2
 None known
coin3
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.0.0+ds-54.0.2+ds-14.0.2+ds-1.1ubuntu14.0.2+ds-1.1ubuntu2
 None known
matanza
Ubuntu:24.04:LTS
 All versions, plus listed versions
0.13+ds2-10.13+ds2-1build10.13+ds2-1build2
 None known
libxmltok
Ubuntu:Pro:24.04:LTS
 before 1.2-4.1ubuntu2.24.0.4.1+esm2, plus listed versions
1.2-4ubuntu11.2-4.1ubuntu11.2-4.1ubuntu21.2-4.1ubuntu2.24.0.4.1+esm1
1.2-4.1ubuntu2.24.0.4.1+esm2
swish-e
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.4.7-6.22.4.7-6.2build12.4.7-6.2build22.4.7-6.2build32.4.7-6.2ubuntu0.1~esm1
 None known
xmlrpc-c
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.33.14-111.33.14-11.11.33.14-121.33.14-12build11.33.14-12build21.33.14-12ubuntu0.1~esm1
 None known
cadaver
Ubuntu:25.10
 All versions, plus listed versions
0.26+dfsg-2
 None known
coin3
Ubuntu:25.10
 All versions, plus listed versions
4.0.3+ds-2
 None known
matanza
Ubuntu:25.10
 All versions, plus listed versions
0.13+ds2-2
 None known
sitecopy
Ubuntu:25.10
 All versions, plus listed versions
1:0.16.6-161:0.16.6-16build1
 None known
swish-e
Ubuntu:25.10
 All versions, plus listed versions
2.4.7-6.32.4.7-6.3build12.4.7-7
 None known
xmlrpc-c
Ubuntu:25.10
 All versions, plus listed versions
1.59.03-71.59.03-91.59.03-101.59.03-10.1
 None known
cadaver
Ubuntu:26.10
 All versions, plus listed versions
0.28+dfsg-2
 None known
coin3
Ubuntu:26.10
 All versions, plus listed versions
4.0.6+ds-14.0.7+ds-1
 None known
matanza
Ubuntu:26.10
 All versions, plus listed versions
0.13+ds2-2build1
 None known
sitecopy
Ubuntu:26.10
 All versions, plus listed versions
1:0.16.6-16build1
 None known
swish-e
Ubuntu:26.10
 All versions, plus listed versions
2.4.7-7.12.4.7-7.22.4.7-7.2build1
 None known
xmlrpc-c
Ubuntu:26.10
 All versions, plus listed versions
1.60.05-11.60.05-1build1
 None known
cadaver
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.26+dfsg-20.28+dfsg-10.28+dfsg-2
 None known
coin3
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.0.3+ds-24.0.6+ds-1
 None known
matanza
Ubuntu:26.04:LTS
 All versions, plus listed versions
0.13+ds2-20.13+ds2-2build1
 None known
sitecopy
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:0.16.6-16build1
 None known
xmlrpc-c
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.59.03-10.11.60.05-1
 None known
swish-e
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.4.7-72.4.7-7.12.4.7-7.1ubuntu0.1~esm1
 None known
libxmltok
Ubuntu:Pro:18.04:LTS
 before 1.2-4ubuntu0.18.04.1~esm1, plus listed versions
1.2-4
1.2-4ubuntu0.18.04.1~esm1
libxmltok
Ubuntu:Pro:20.04:LTS
 before 1.2-4ubuntu0.20.04.1~esm1, plus listed versions
1.2-4
1.2-4ubuntu0.20.04.1~esm1
libxmltok
Ubuntu:Pro:22.04:LTS
 before 1.2-4ubuntu0.22.04.1~esm1, plus listed versions
1.2-4
1.2-4ubuntu0.22.04.1~esm1
MozillaFirefox
openSUSE:Tumbleweed
 before 50.1.0-1.1
50.1.0-1.1
expat
openSUSE:Tumbleweed
 before 2.2.0-3.1
2.2.0-3.1
firefox-esr
openSUSE:Tumbleweed
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-0718 is a critical vulnerability (CVSS 9.8) in Apple Mac Os X, published May 17, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.3%, the 96th percentile. Fixed in expat 2.1.1-r1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 2,160 references and the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open