{"id":"CVE-2021-45960","aliases":["ALPINE-CVE-2021-45960","ALSA-2022:0951","AZL-7124","BELL-CVE-2021-45960","CLSA-2022-1660757175","CLSA-2022-1660758476","CLSA-2022-1660759632","CLSA-2022-1660760528","CLSA-2022-1660762248","DEBIAN-CVE-2021-45960","DLA-2904-1","DSA-5073-1","EUVD-2021-32666","GHSA-pfmv-2r4f-j9mj","JLSEC-2025-42","MGASA-2022-0031","OESA-2022-1490","OESA-2023-1464","OESA-2023-1465","OESA-2024-1815","RHSA-2022:0951","RHSA-2022:1069","RHSA-2025:22785","RHSA-2025:22871","RLSA-2022:0951","SUSE-SU-2022:0178-1","SUSE-SU-2022:0179-1","SUSE-SU-2022:14878-1","UBUNTU-CVE-2021-45960","USN-5288-1","openSUSE-SU-2022:0178-1","openSUSE-SU-2024:11762-1"],"status":"published","title":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts...","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.04672,"percentile":0.91893,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-400","CWE-682"],"published":"2022-01-01T18:47:46Z","modified":"2026-10-29T11:01:15Z","exploits":[{"source":"pocgithub","id":"nanopathi/external_expat_AOSP10_r33_CVE-2021-45960","title":"nanopathi/external_expat_AOSP10_r33_CVE-2021-45960","date":"2022-04-11","url":"https://github.com/nanopathi/external_expat_AOSP10_r33_CVE-2021-45960"},{"source":"pocgithub","id":"Trinadh465/external_lib_AOSP10_r33_CVE-2021-45960_CVE-2021-46143-","title":"Trinadh465/external_lib_AOSP10_r33_CVE-2021-45960_CVE-2021-46143-","date":"2022-05-25","url":"https://github.com/Trinadh465/external_lib_AOSP10_r33_CVE-2021-45960_CVE-2021-46143-"}],"fixes":[{"ecosystem":"Alpine:v3.12","package":"expat","fixed_in":["2.2.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"expat","fixed_in":["2.2.10-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"expat","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"expat","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"expat","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"expat","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"expat","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"expat","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"expat","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"expat","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"expat","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"expat","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"expat","fixed_in":["2.4.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"expat","fixed_in":["2.4.3-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"expat","fixed_in":["2.4.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.4.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.4.3-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Expat_jll","fixed_in":["2.4.4+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","fixed_in":["2.1.0-4ubuntu1.4+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","fixed_in":["2.1.0-7ubuntu0.16.04.5+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"expat","fixed_in":["2.2.5-3ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"firefox","fixed_in":["98.0+build3-0ubuntu0.18.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"expat","fixed_in":["2.2.9-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"firefox","fixed_in":["98.0+build3-0ubuntu0.20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"expat","fixed_in":["2.4.3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"firefox","fixed_in":["1:1snap1-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-8.el8_6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-8.el8_6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"Azure Linux:2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els1"}]}],"bundled":13},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els1"}]}],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els1"}]}],"bundled":13},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els1"}]}],"bundled":13},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4.1","1.2-4.1~exp1","1.2-4.2"]},{"source":"osv","ecosystem":"Debian:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-2+deb9u4"}]}],"versions":["2.2.0-2","2.2.0-2+deb9u1","2.2.0-2+deb9u2","2.2.0-2+deb9u3"],"bundled":10},{"source":"osv","ecosystem":"Debian:10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u2"}]}],"versions":["2.2.6-2","2.2.6-2+deb10u1"],"bundled":10},{"source":"osv","ecosystem":"Debian:11","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u1"}]}],"versions":["2.2.10-2"],"bundled":10},{"source":"osv","ecosystem":"Julia","package":"Expat_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-1.1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-4.oe1"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-4.oe1"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-4.oe1"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"79.0-12.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"79.0-12.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.4.0-9.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_5.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_5.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_5.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_5.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_2"}]}],"bundled":18},{"source":"osv","ecosystem":"Rocky Linux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_5.3"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-88.42.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-88.42.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm4"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50-3","3.1.4~abc9f50-4","3.1.4~abc9f50-4ubuntu2","3.1.4~abc9f50-4ubuntu2+esm1","3.1.4~abc9f50-4ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37ubuntu5","4.1.1+xorg4.3.0-37ubuntu5.0.1","4.1.1+xorg4.3.0-37ubuntu5.0.2","4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14ubuntu1","5.8.0-14ubuntu3","5.8.0-14.1ubuntu2","5.8.0-14.1ubuntu3","5.8.0-14.1ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.33-3.2ubuntu3","1.33.06-0ubuntu1","1.33.06-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm2"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ayttm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.3-3build1","0.6.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cableswig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0+git20150808-1","0.1.0+git20150808-2","0.1.0+git20150808-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"insighttoolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20.1+git20120521-6","3.20.1+git20120521-6build1","3.20.1+git20120521-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1ubuntu3","4.8.1-1ubuntu4","4.8.2-3.1ubuntu1","4.9.0-3ubuntu2","4.9.0-4ubuntu1","4.9.0-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-4","2.4.7-4build1","2.4.7-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2","4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.1+dfsg-2","5.10.1+dfsg-2build3","5.10.1+dfsg-2.1build1","5.10.1+dfsg-2.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-0.2ubuntu3","1.33.14-1ubuntu1","1.33.14-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.4"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"98.0+build3-0ubuntu0.18.04.2"}]}],"versions":["56.0+build6-0ubuntu1","57.0.1+build2-0ubuntu1","59.0.1+build1-0ubuntu1","59.0.2+build1-0ubuntu1","60.0+build2-0ubuntu1","60.0.1+build2-0ubuntu0.18.04.1","60.0.2+build1-0ubuntu0.18.04.1","61.0+build3-0ubuntu0.18.04.1","61.0.1+build1-0ubuntu0.18.04.1","62.0+build2-0ubuntu0.18.04.3","62.0+build2-0ubuntu0.18.04.4","62.0+build2-0ubuntu0.18.04.5","62.0.3+build1-0ubuntu0.18.04.1","63.0+build2-0ubuntu0.18.04.2","63.0.3+build1-0ubuntu0.18.04.1","64.0+build3-0ubuntu0.18.04.1","65.0+build2-0ubuntu0.18.04.1","65.0.1+build2-0ubuntu0.18.04.1","66.0+build3-0ubuntu0.18.04.1","66.0.1+build1-0ubuntu0.18.04.1","66.0.2+build1-0ubuntu0.18.04.1","66.0.3+build1-0ubuntu0.18.04.1","66.0.4+build3-0ubuntu0.18.04.1","66.0.5+build1-0ubuntu0.18.04.1","67.0+build2-0ubuntu0.18.04.1","67.0.1+build1-0ubuntu0.18.04.1","67.0.2+build2-0ubuntu0.18.04.1","67.0.3+build1-0ubuntu0.18.04.1","67.0.4+build1-0ubuntu0.18.04.1","68.0+build3-0ubuntu0.18.04.1","68.0.1+build1-0ubuntu0.18.04.1","68.0.2+build1-0ubuntu0.18.04.1","69.0+build2-0ubuntu0.18.04.1","69.0.1+build1-0ubuntu0.18.04.1","69.0.2+build1-0ubuntu0.18.04.1","70.0+build2-0ubuntu0.18.04.1","70.0.1+build1-0ubuntu0.18.04.1","71.0+build5-0ubuntu0.18.04.1","72.0.1+build1-0ubuntu0.18.04.1","72.0.2+build1-0ubuntu0.18.04.1","73.0+build3-0ubuntu0.18.04.1","73.0.1+build1-0ubuntu0.18.04.1","74.0+build3-0ubuntu0.18.04.1","74.0.1+build1-0ubuntu0.18.04.1","75.0+build3-0ubuntu0.18.04.1","76.0+build2-0ubuntu0.18.04.1","76.0.1+build1-0ubuntu0.18.04.1","77.0.1+build1-0ubuntu0.18.04.1","78.0.1+build1-0ubuntu0.18.04.1","78.0.2+build2-0ubuntu0.18.04.1","79.0+build1-0ubuntu0.18.04.1","80.0+build2-0ubuntu0.18.04.1","80.0.1+build1-0ubuntu0.18.04.1","81.0+build2-0ubuntu0.18.04.1","81.0.2+build1-0ubuntu0.18.04.1","82.0+build2-0ubuntu0.18.04.1","82.0.2+build1-0ubuntu0.18.04.1","82.0.3+build1-0ubuntu0.18.04.1","83.0+build2-0ubuntu0.18.04.2","84.0+build3-0ubuntu0.18.04.1","84.0.1+build1-0ubuntu0.18.04.1","84.0.2+build1-0ubuntu0.18.04.1","85.0+build1-0ubuntu0.18.04.1","85.0.1+build1-0ubuntu0.18.04.1","86.0+build3-0ubuntu0.18.04.1","86.0.1+build1-0ubuntu0.18.04.1","87.0+build3-0ubuntu0.18.04.2","88.0+build2-0ubuntu0.18.04.2","88.0.1+build1-0ubuntu0.18.04.2","89.0+build2-0ubuntu0.18.04.2","89.0.1+build1-0ubuntu0.18.04.1","89.0.2+build1-0ubuntu0.18.04.1","90.0+build1-0ubuntu0.18.04.1","90.0.2+build1-0ubuntu0.18.04.1","91.0+build2-0ubuntu0.18.04.1","91.0.1+build1-0ubuntu0.18.04.1","91.0.2+build1-0ubuntu0.18.04.1","92.0+build3-0ubuntu0.18.04.1","93.0+build1-0ubuntu0.18.04.1","94.0+build3-0ubuntu0.18.04.1","95.0+build1-0ubuntu0.18.04.1","95.0.1+build2-0ubuntu0.18.04.1","96.0+build2-0ubuntu0.18.04.1","97.0+build2-0ubuntu0.18.04.1","97.0.2+build1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-2","3.1.4~abc9f50+dfsg2-1","3.1.4~abc9f50+dfsg3-1","3.1.4~abc9f50+dfsg3-2","3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5build1","0.13+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-5ubuntu1","2.4.7-5ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1","0.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-7","1.33.14-8","1.33.14-8build1","1.33.14-8ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.2"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"98.0+build3-0ubuntu0.20.04.2"}]}],"versions":["69.0.3+build1-0ubuntu1","70.0+build2-0ubuntu1","70.0+build2-0ubuntu2","70.0.1+build1-0ubuntu2","71.0+build2-0ubuntu2","71.0+build5-0ubuntu1","72.0.1+build1-0ubuntu1","72.0.2+build1-0ubuntu1","73.0+build1-0ubuntu1","73.0+build2-0ubuntu1","73.0+build3-0ubuntu1","73.0.1+build1-0ubuntu1","74.0+build1-0ubuntu1","74.0+build2-0ubuntu1","74.0+build2-0ubuntu2","74.0+build3-0ubuntu1","75.0+build3-0ubuntu1","76.0+build2-0ubuntu0.20.04.1","76.0.1+build1-0ubuntu0.20.04.1","77.0.1+build1-0ubuntu0.20.04.1","78.0.1+build1-0ubuntu0.20.04.1","78.0.2+build2-0ubuntu0.20.04.1","79.0+build1-0ubuntu0.20.04.1","80.0+build2-0ubuntu0.20.04.1","80.0.1+build1-0ubuntu0.20.04.1","81.0+build2-0ubuntu0.20.04.1","81.0.2+build1-0ubuntu0.20.04.1","82.0+build2-0ubuntu0.20.04.1","82.0.2+build1-0ubuntu0.20.04.1","82.0.3+build1-0ubuntu0.20.04.1","83.0+build2-0ubuntu0.20.04.1","84.0+build3-0ubuntu0.20.04.1","84.0.1+build1-0ubuntu0.20.04.1","84.0.2+build1-0ubuntu0.20.04.1","85.0+build1-0ubuntu0.20.04.1","85.0.1+build1-0ubuntu0.20.04.1","86.0+build3-0ubuntu0.20.04.1","86.0.1+build1-0ubuntu0.20.04.1","87.0+build3-0ubuntu0.20.04.2","88.0+build2-0ubuntu0.20.04.1","88.0.1+build1-0ubuntu0.20.04.2","89.0+build2-0ubuntu0.20.04.2","89.0.1+build1-0ubuntu0.20.04.1","89.0.2+build1-0ubuntu0.20.04.1","90.0+build1-0ubuntu0.20.04.1","90.0.2+build1-0ubuntu0.20.04.1","91.0+build2-0ubuntu0.20.04.1","91.0.1+build1-0ubuntu0.20.04.1","91.0.2+build1-0ubuntu0.20.04.1","92.0+build3-0ubuntu0.20.04.1","93.0+build1-0ubuntu0.20.04.1","94.0+build3-0ubuntu0.20.04.1","95.0+build1-0ubuntu0.20.04.1","95.0.1+build2-0ubuntu0.20.04.1","96.0+build2-0ubuntu0.20.04.1","97.0+build2-0ubuntu0.20.04.1","97.0.2+build1-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-6","0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build1","2.4.7-6build2","2.4.7-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-8build1","1.33.14-8build2","1.33.14-8ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1snap1-0ubuntu1"}]}],"versions":["93.0+build1-0ubuntu3","94.0+build3-0ubuntu1","94.0.2+build1-0ubuntu1","94.0.2+build2-0ubuntu1","95.0+build1-0ubuntu1","95.0.1+build2-0ubuntu1","95.0.2+build1-0ubuntu1","96.0+build2-0ubuntu1","96.0.1+build1-0ubuntu1","96.0.2+build1-0ubuntu1","96.0.3+build1-0ubuntu1","97.0+build1-0ubuntu1","97.0+build2-0ubuntu1","97.0.1+build1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1","0.11.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build3","2.4.7-6.1","2.4.7-6.1build1","2.4.7-6.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-9","1.33.14-10","1.33.14-10ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24+dfsg-2","0.24+dfsg-3","0.24+dfsg-3build1","0.24+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1","0.13+ds2-1build1","0.13+ds2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.3-1","0.9.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.8+dfsg-3","0.11.8+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.2","2.4.7-6.2build1","2.4.7-6.2build2","2.4.7-6.2build3","2.4.7-6.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-11","1.33.14-11.1","1.33.14-12","1.33.14-12build1","1.33.14-12build2","1.33.14-12ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.3","2.4.7-6.3build1","2.4.7-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-2","0.9.5.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-7","1.59.03-9","1.59.03-10","1.59.03-10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7.1","2.4.7-7.2","2.4.7-7.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-2","0.9.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-3","0.11.10+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.05-1","1.60.05-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2","0.28+dfsg-1","0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2","0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-3","0.9.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2","0.11.10+dfsg-2build1","0.11.10+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-10.1","1.60.05-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7","2.4.7-7.1","2.4.7-7.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm4"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm2"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.4"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.2"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.9.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-1.1"}]}],"bundled":8}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libexpat_project","product":"libexpat"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"hci_baseboard_management_controller"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinema_remote_connect_server"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"tenable","product":"nessus"}],"references":[{"url":"https://github.com/libexpat/libexpat/issues/531","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web","article"]},{"url":"https://github.com/libexpat/libexpat/pull/534","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1217609","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Permissions Required","Third Party Advisory","report","web"]},{"url":"http://www.openwall.com/lists/oss-security/2022/01/17/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220121-0004/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.tenable.com/security/tns-2022-05","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2022/dsa-5073","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.gentoo.org/glsa/202209-24","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-484086.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45960","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220121-0004"},{"url":"https://github.com/advisories/GHSA-pfmv-2r4f-j9mj"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-45960","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0951","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45960","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-46143","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22822","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22823","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22824","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22825","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22826","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22827","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23852","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25235","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25236","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25315","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044451","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044455","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044457","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044464","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044467","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044479","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044484","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044488","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044613","tags":["report"]},{"url":"https://bugzilla.redhat.com/2056363","tags":["report"]},{"url":"https://bugzilla.redhat.com/2056366","tags":["report"]},{"url":"https://bugzilla.redhat.com/2056370","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-0951.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-45960","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1660757175.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1660758476.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1660759632.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1660760528","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1660762248.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-45960","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0031.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29902","tags":["report"]},{"url":"https://blog.hartwork.org/posts/expat-2-4-3-released/","tags":["web"]},{"url":"https://github.com/libexpat/libexpat/blob/R_2_4_3/expat/Changes","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1490","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22827","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46143","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1464","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1465","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1815","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25235","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044457","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044488","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056370","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0951.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45960","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46143","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/532","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22822","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/pull/539","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22823","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22824","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22825","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22826","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22827","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23852","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23852","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/pull/550","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25235","tags":["advisory"]},{"url":"https://blog.hartwork.org/posts/expat-2-4-5-released/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25236","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25315","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25315","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1069","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1069.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22785","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1000109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056354","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2310137","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2395108","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22785.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0340","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0340","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23990","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23990","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25313","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25313","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25313","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25314","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25314","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25314","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43680","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43680","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/649","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-52425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52425","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52425","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-8176","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-8176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8176","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/893","tags":["article"]},{"url":"https://github.com/libexpat/libexpat/pull/973","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59375","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2025-59375","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2025-59375","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22871","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1752592","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22871.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20843","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20843","tags":["advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15903","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15903","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:0951","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220178-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194251","tags":["report"]},{"url":"https://bugzilla.suse.com/1194362","tags":["report"]},{"url":"https://bugzilla.suse.com/1194474","tags":["report"]},{"url":"https://bugzilla.suse.com/1194476","tags":["report"]},{"url":"https://bugzilla.suse.com/1194477","tags":["report"]},{"url":"https://bugzilla.suse.com/1194478","tags":["report"]},{"url":"https://bugzilla.suse.com/1194479","tags":["report"]},{"url":"https://bugzilla.suse.com/1194480","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22827","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220179-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214878-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-45960","tags":["report"]},{"url":"https://github.com/libexpat/libexpat/pull/534/commits/0adcb34c49bee5b19bd29b16a578c510c23597ea","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5288-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-46143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23852","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-25235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-25236","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5POFOWWCWJ3SLTEUIQRMKXQB4GOECNOP/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-45960","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).","status":"published","published":"2022-01-01T18:47:46Z","modified":"2026-10-14T12:03:11.369Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T14:33:02.580561Z"}],"euvd":[{"id":"EUVD-2021-32666","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).","status":"published","published":"2022-01-01T18:47:46Z","modified":"2026-10-14T12:03:11Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:15.969628Z"}],"ghsa":[{"id":"GHSA-pfmv-2r4f-j9mj","title":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts...","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).","status":"published","published":"2022-02-10T00:01:20Z","modified":"2026-10-14T15:31:11Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-400","CWE-682"],"updated_at":"2026-11-02T15:13:24.812204Z"}],"nvd":[{"id":"CVE-2021-45960","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).","status":"published","published":"2022-01-01T19:15:08.03Z","modified":"2026-10-14T13:17:10.723Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-682"],"updated_at":"2026-11-02T14:07:02.977492Z"}],"osv":[{"id":"ALPINE-CVE-2021-45960","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).","status":"published","published":"2022-01-01T19:15:08.03Z","modified":"2026-10-23T17:17:56.230049594Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-7124","title":"CVE-2021-45960 affecting package expat for versions less than 2.4.3-1","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).","status":"published","published":"2022-01-01T19:15:08Z","modified":"2026-04-21T04:36:32.9421Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"BELL-CVE-2021-45960","title":"CVE-2021-45960 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:08.564511Z","modified":"2026-01-26T10:04:53.782314Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-45960","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).","status":"published","published":"2022-01-01T19:15:08.03Z","modified":"2026-10-20T10:54:12.520226945Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:22.18434Z"},{"id":"DEBIAN-CVE-2021-45960","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).","status":"published","published":"2022-01-01T19:15:08.03Z","modified":"2026-10-15T09:47:36.120363525Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"JLSEC-2025-42","title":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function...","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).","status":"published","published":"2025-10-14T15:35:41.198Z","modified":"2026-07-25T18:23:43.173239294Z","cvss":[{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"critical"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2022-1490","title":"expat security update","description":"An XML parser library.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).(CVE-2021-45960)\r\n\r\nlookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22825)\r\n\r\nstoreAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22827)\r\n\r\naddBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22822)\r\n\r\nnextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22826)\r\n\r\nbuild_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22823)\r\n\r\ndefineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22824)\r\n\r\nIn doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.(CVE-2021-46143)","status":"published","published":"2022-01-18T11:04:46Z","modified":"2026-08-18T01:16:20.50118808Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"OESA-2023-1464","title":"firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).(CVE-2021-45960)\r\n\r\nIn doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.(CVE-2021-46143)\r\n\r\nlookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22825)\r\n\r\nnextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22826)\r\n\r\nstoreAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22827)","status":"published","published":"2023-08-06T11:05:55Z","modified":"2026-08-18T01:17:45.696741757Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1465","title":"firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).(CVE-2021-45960)\r\n\r\nIn doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.(CVE-2021-46143)\r\n\r\nlookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22825)\r\n\r\nnextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22826)\r\n\r\nstoreAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.(CVE-2022-22827)","status":"published","published":"2023-08-06T11:05:55Z","modified":"2026-08-18T01:17:46.245203152Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2024-1815","title":"mozjs78 security update","description":"Security Fix(es):\r\n\r\nIn Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).(CVE-2021-45960)\r\n\r\nxmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.(CVE-2022-25235)","status":"published","published":"2024-07-05T11:07:17Z","modified":"2026-08-18T01:18:29.018392999Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2022:0951","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-17T01:16:00Z","modified":"2026-10-15T10:02:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1069","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-17T01:16:40Z","modified":"2026-10-15T10:02:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2025:22785","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-12-05T10:08:28Z","modified":"2026-10-15T10:10:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:22871","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-12-09T10:06:09Z","modified":"2026-10-15T10:10:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RLSA-2022:0951","title":"Important: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)\n\n* expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution (CVE-2022-25236)\n\n* expat: Integer overflow in storeRawNames() (CVE-2022-25315)\n\n* expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)\n\n* expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)\n\n* expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)\n\n* expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)\n\n* expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)\n\n* expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)\n\n* expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)\n\n* expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)\n\n* expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-03-16T15:13:06Z","modified":"2026-02-04T07:40:22.968789Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-45960","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).","status":"published","published":"2022-01-01T19:15:00Z","modified":"2026-10-17T12:57:15.139894473Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:30.277322Z"},{"id":"ALSA-2022:0951","title":"Important: expat security update","description":"Expat is a C library for parsing XML documents.\nSecurity Fix(es):\n* expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)\n* expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution (CVE-2022-25236)\n* expat: Integer overflow in storeRawNames() (CVE-2022-25315)\n* expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)\n* expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)\n* expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)\n* expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)\n* expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)\n* expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)\n* expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)\n* expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)\n* expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-03-16T00:00:00Z","modified":"2026-10-29T11:01:15.158791294Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2022-1660757175","title":"Fixed 15 CVEs in expat","description":"- CVE-2022-25236: Fix insertion of namespace-separator characters into\n  namespace URIs\n- CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to\n  arbitrary code execution\n- CVE-2022-25315: Fix integer overflow in storeRawNames()\n- CVE-2022-22822: Fix integer overflow in addBinding()\n- CVE-2022-22823: Fix integer overflow in build_model()\n- CVE-2022-22824: Fix integer overflow in defineAttribute()\n- CVE-2022-22825: Fix integer overflow in lookup()\n- CVE-2022-22826: Fix integer overflow in nextScaffoldPart()\n- CVE-2022-22827: Fix integer overflow in storeAtts()\n- CVE-2022-23852: Fix integer overflow in XML_GetBuffer()\n- CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()\n- CVE-2021-45960: Fix troublesome left shifts in storeAtts()\n- CVE-2022-23990: Fix integer overflow in doProlog()\n- CVE-2022-25313: Fix stack exhaustion in build_model()\n- CVE-2022-25314: Fix integer overflow in copyString()","status":"published","published":"2022-08-17T17:26:15Z","modified":"2026-10-21T10:47:56.534771217Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660758476","title":"Fixed 15 CVEs in expat","description":"- CVE-2022-25236: Fix insertion of namespace-separator characters into\n  namespace URIs\n- CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to\n  arbitrary code execution\n- CVE-2022-25315: Fix integer overflow in storeRawNames()\n- CVE-2022-22822: Fix integer overflow in addBinding()\n- CVE-2022-22823: Fix integer overflow in build_model()\n- CVE-2022-22824: Fix integer overflow in defineAttribute()\n- CVE-2022-22825: Fix integer overflow in lookup()\n- CVE-2022-22826: Fix integer overflow in nextScaffoldPart()\n- CVE-2022-22827: Fix integer overflow in storeAtts()\n- CVE-2022-23852: Fix integer overflow in XML_GetBuffer()\n- CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()\n- CVE-2021-45960: Fix troublesome left shifts in storeAtts()\n- CVE-2022-23990: Fix integer overflow in doProlog()\n- CVE-2022-25313: Fix stack exhaustion in build_model()\n- CVE-2022-25314: Fix integer overflow in copyString()","status":"published","published":"2022-08-17T17:47:56Z","modified":"2026-10-21T10:47:51.665937197Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660759632","title":"Fixed 13 CVEs in expat","description":"- CVE-2022-25236: Fix insertion of namespace-separator characters into\n  namespace URIs\n- CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to\n  arbitrary code execution\n- CVE-2022-25315: Fix integer overflow in storeRawNames()\n- CVE-2022-22822: Fix integer overflow in addBinding()\n- CVE-2022-22823: Fix integer overflow in build_model()\n- CVE-2022-22824: Fix integer overflow in defineAttribute()\n- CVE-2022-22825: Fix integer overflow in lookup()\n- CVE-2022-22826: Fix integer overflow in nextScaffoldPart()\n- CVE-2022-22827: Fix integer overflow in storeAtts()\n- CVE-2022-23852: Fix integer overflow in XML_GetBuffer()\n- CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()\n- CVE-2021-45960: Fix troublesome left shifts in storeAtts()\n- CVE-2022-23990: Fix integer overflow in doProlog()","status":"published","published":"2022-08-17T18:07:12Z","modified":"2026-10-21T10:48:01.406135998Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660760528","title":"Fix CVE(s): CVE-2022-25235, CVE-2022-23990, CVE-2022-22825, CVE-2022-22824, CVE-2022-23852, CVE-2022-25315, CVE-2022-25236, CVE-2021-46143, CVE-2022-25313, CVE-2021-45960, CVE-2022-22826, CVE-2022-22827, CVE-2022-22822, CVE-2022-22823","description":"\n   * SECURITY UPDATE: Stack exhaustion\n     - debian/patches/CVE-2022-25313.patch: prevent\n       stack exhaustion in build_model in expat/lib/xmlparse.c.\n     - debian/patches/fix-build_model-regression.patch: fix build_model\n       regression in expat/lib/xmlparse.c.\n     - CVE-2022-25313\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2022-25315.patch: prevent integer overflow in\n       storeRawNames in expat/lib/xmlparse.c.\n     - CVE-2022-25315\n   * SECURITY UPDATE: relax fix to CVE-2022-25236 with regard to\n     RFC 3986 URI characters and possibly regressions\n     - debian/patches/CVE-2022-25236-3.patch: add a note on namespace URI\n       validation in expat/doc/reference.html, expat/lib/expat.h.\n     - debian/patches/CVE-2022-25236-4.patch: document namespace separator\n       effect right in header expat/lib/expat.h.\n     - debian/patches/CVE-2022-25236-5.patch: cover relaxed fix in tests.\n     - debian/patches/CVE-2022-25236-6.patch: relax fix with regard to\n       RFC 3986 URI characters in expat/lib/xmlparse.c. (LP: #1963903)\n   * fix tests adding XCS definition\n     - debian/patches/fix_test_xcs.patch: in tests/runtests.c.\n   * SECURITY UPDATE: Realloc misbehavior\n     - debian/patches/CVE-2021-45960.patch: detect and prevent troublesome\n       left shifts in function storeAtts in lib/xmlparse.c.\n     - CVE-2021-45960\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2021-46143.patch: prevent integer overflow\n       on m_groupSize in function doProlog in lib/xmlparse.c.\n     - CVE-2021-46143\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2022-22822-to-CVE-2022-22827.patch: prevent integer overflow\n       in multiple places in lib/xmlparse.c.\n     - CVE-2022-22822\n     - CVE-2022-22823\n     - CVE-2022-22824\n     - CVE-2022-22825\n     - CVE-2022-22826\n     - CVE-2022-22827\n   * SECURITY UPDATE: Signed integer overflow\n     - debian/patches/CVE-2022-23852-*.patch: detect and prevent\n       integer overflow in XML_GetBuffer in expat/lib/xmlparse.c and\n       adds test to cover it in tests/runtests.c.\n     - CVE-2022-23852\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2022-23990.patch: prevent integer overflow in\n       doProlog in lib/xmlparse.c.\n     - CVE-2022-23990\n   * SECURITY UPDATE: Incomplete validation encoding\n     - debian/patches/CVE-2022-25235-*.patch: adds missing validation\n       and adds tests in expat/lib/xmltok_impl.c, expat/tests/runtests.c.\n     - CVE-2022-25235\n   * SECURITY UPDATE: Namespace-separator insertions\n     - debian/patches/CVE-2022-25236-*.patch: Protect against malicious\n       namespace declarations in expat/lib/xmlparse.c, expat/tests/runtests.c.\n     - CVE-2022-25236\n   * debian/patches/fixing_tests.patch: fixing tests in order to it work\n     in xenial and oldest releases.","status":"published","published":"2022-08-17T18:22:08Z","modified":"2026-06-04T10:04:12.695059494Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660762248","title":"Fixed 13 CVEs in expat","description":"- CVE-2022-25236: Fix insertion of namespace-separator characters into\n  namespace URIs\n- CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to\n  arbitrary code execution\n- CVE-2022-25315: Fix integer overflow in storeRawNames()\n- CVE-2022-22822: Fix integer overflow in addBinding()\n- CVE-2022-22823: Fix integer overflow in build_model()\n- CVE-2022-22824: Fix integer overflow in defineAttribute()\n- CVE-2022-22825: Fix integer overflow in lookup()\n- CVE-2022-22826: Fix integer overflow in nextScaffoldPart()\n- CVE-2022-22827: Fix integer overflow in storeAtts()\n- CVE-2022-23852: Fix integer overflow in XML_GetBuffer()\n- CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()\n- CVE-2021-45960: Fix troublesome left shifts in storeAtts()\n- CVE-2022-23990: Fix integer overflow in doProlog()","status":"published","published":"2022-08-17T18:50:48Z","modified":"2026-10-21T10:47:13.304977424Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"DLA-2904-1","title":"expat - security update","status":"published","published":"2022-01-30T00:00:00Z","modified":"2026-03-09T01:18:56.856358Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5073-1","title":"expat - security update","status":"published","published":"2022-02-12T00:00:00Z","modified":"2026-03-09T02:09:22.806264Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0031","title":"Updated expat packages fix security vulnerability","description":"In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places\nin the storeAtts function in xmlparse.c can lead to realloc misbehavior\n(e.g., allocating too few bytes, or only freeing memory). (CVE-2021-45960)\n\nIn doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer\noverflow exists for m_groupSize. (CVE-2021-46143)\n\naddBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an\ninteger overflow. (CVE-2022-22822)\n\nbuild_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an\ninteger overflow. (CVE-2022-22823)\n\ndefineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an\ninteger overflow. (CVE-2022-22824)\n\nlookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer\noverflow. (CVE-2022-22825)\n\nnextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an\ninteger overflow. (CVE-2022-22826)\n\nstoreAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an\ninteger overflow. (CVE-2022-22827)\n","status":"published","published":"2022-01-25T12:13:11Z","modified":"2026-04-16T04:41:28.846962496Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0178-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n  \n- CVE-2021-45960: Fixed left shift in the storeAtts function in xmlparse.c that can lead to realloc misbehavior (bsc#1194251).\n- CVE-2021-46143: Fixed integer overflow in m_groupSize in doProlog (bsc#1194362).\n- CVE-2022-22822: Fixed integer overflow in addBinding in xmlparse.c (bsc#1194474).\n- CVE-2022-22823: Fixed integer overflow in build_model in xmlparse.c (bsc#1194476).\n- CVE-2022-22824: Fixed integer overflow in defineAttribute in xmlparse.c (bsc#1194477).\n- CVE-2022-22825: Fixed integer overflow in lookup in xmlparse.c (bsc#1194478).\n- CVE-2022-22826: Fixed integer overflow in nextScaffoldPart in xmlparse.c (bsc#1194479).\n- CVE-2022-22827: Fixed integer overflow in storeAtts in xmlparse.c (bsc#1194480).  \n","status":"published","published":"2022-01-25T13:16:34Z","modified":"2026-02-04T04:37:42.957321Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11762-1","title":"expat-2.4.3-1.1 on GA media","description":"These are all security issues fixed in the expat-2.4.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:28:08.366543Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2022:0178-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n  \n- CVE-2021-45960: Fixed left shift in the storeAtts function in xmlparse.c that can lead to realloc misbehavior (bsc#1194251).\n- CVE-2021-46143: Fixed integer overflow in m_groupSize in doProlog (bsc#1194362).\n- CVE-2022-22822: Fixed integer overflow in addBinding in xmlparse.c (bsc#1194474).\n- CVE-2022-22823: Fixed integer overflow in build_model in xmlparse.c (bsc#1194476).\n- CVE-2022-22824: Fixed integer overflow in defineAttribute in xmlparse.c (bsc#1194477).\n- CVE-2022-22825: Fixed integer overflow in lookup in xmlparse.c (bsc#1194478).\n- CVE-2022-22826: Fixed integer overflow in nextScaffoldPart in xmlparse.c (bsc#1194479).\n- CVE-2022-22827: Fixed integer overflow in storeAtts in xmlparse.c (bsc#1194480).  \n","status":"published","published":"2022-01-25T13:17:32Z","modified":"2026-02-04T02:20:43.424605Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0179-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2021-45960: Fixed left shift in the storeAtts function in xmlparse.c that can lead to realloc misbehavior (bsc#1194251).\n- CVE-2021-46143: Fixed integer overflow in m_groupSize in doProlog (bsc#1194362).\n- CVE-2022-22822: Fixed integer overflow in addBinding in xmlparse.c (bsc#1194474).\n- CVE-2022-22823: Fixed integer overflow in build_model in xmlparse.c (bsc#1194476).\n- CVE-2022-22824: Fixed integer overflow in defineAttribute in xmlparse.c (bsc#1194477).\n- CVE-2022-22825: Fixed integer overflow in lookup in xmlparse.c (bsc#1194478).\n- CVE-2022-22826: Fixed integer overflow in nextScaffoldPart in xmlparse.c (bsc#1194479).\n- CVE-2022-22827: Fixed integer overflow in storeAtts in xmlparse.c (bsc#1194480).\n","status":"published","published":"2022-01-25T13:18:54Z","modified":"2026-02-04T03:16:43.977076Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:14878-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2021-45960: Fixed left shift in the storeAtts function in xmlparse.c that can lead to realloc misbehavior (bsc#1194251).\n- CVE-2021-46143: Fixed integer overflow in m_groupSize in doProlog (bsc#1194362).\n- CVE-2022-22822: Fixed integer overflow in addBinding in xmlparse.c (bsc#1194474).\n- CVE-2022-22823: Fixed integer overflow in build_model in xmlparse.c (bsc#1194476).\n- CVE-2022-22824: Fixed integer overflow in defineAttribute in xmlparse.c (bsc#1194477).\n- CVE-2022-22825: Fixed integer overflow in lookup in xmlparse.c (bsc#1194478).\n- CVE-2022-22826: Fixed integer overflow in nextScaffoldPart in xmlparse.c (bsc#1194479).\n- CVE-2022-22827: Fixed integer overflow in storeAtts in xmlparse.c (bsc#1194480).\n","status":"published","published":"2022-01-25T12:57:53Z","modified":"2026-02-04T02:49:49.564262Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5288-1","title":"expat vulnerabilities","description":"It was discovered that Expat incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a crash or\nexecute arbitrary code.\n","status":"published","published":"2022-02-21T14:48:40Z","modified":"2026-06-29T13:49:35.689531107Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}