{"id":"CVE-2022-23852","aliases":["A-221255869","ALPINE-CVE-2022-23852","ALSA-2022:0951","ASB-A-221255869","AZL-7835","BELL-CVE-2022-23852","CLSA-2022-1660757175","CLSA-2022-1660758476","CLSA-2022-1660759632","CLSA-2022-1660760528","CLSA-2022-1660762248","DEBIAN-CVE-2022-23852","DLA-2904-1","DLA-2935-1","DSA-5073-1","EUVD-2022-28778","GHSA-h83g-c7g2-6r9h","JLSEC-2025-50","MGASA-2022-0048","OESA-2022-1511","RHBA-2022:4046","RHSA-2022:0951","RHSA-2022:1069","RHSA-2022:4834","RLSA-2022:0951","SUSE-SU-2022:0495-1","SUSE-SU-2022:0498-1","SUSE-SU-2022:14884-1","UBUNTU-CVE-2022-23852","USN-5288-1","openSUSE-SU-2022:0498-1","openSUSE-SU-2024:11793-1","openSUSE-SU-2024:11985-1"],"status":"published","title":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for...","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.05083,"percentile":0.9241,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-190"],"published":"2022-01-24T01:06:50Z","modified":"2026-11-05T16:32:28Z","exploits":[{"source":"pocgithub","id":"Satheesh575555/external_expat_AOSP10_r33_CVE-2022-23852","title":"Satheesh575555/external_expat_AOSP10_r33_CVE-2022-23852","date":"2022-05-10","url":"https://github.com/Satheesh575555/external_expat_AOSP10_r33_CVE-2022-23852"}],"fixes":[{"ecosystem":"Alpine:v3.12","package":"expat","fixed_in":["2.2.10-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"expat","fixed_in":["2.2.10-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"expat","fixed_in":["2.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"expat","fixed_in":["2.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"expat","fixed_in":["2.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"expat","fixed_in":["2.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"expat","fixed_in":["2.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"expat","fixed_in":["2.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"expat","fixed_in":["2.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"expat","fixed_in":["2.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"expat","fixed_in":["2.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"expat","fixed_in":["2.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"expat","fixed_in":["2.4.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"qt5-qtwebengine","fixed_in":["5.15.3_git20211127-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"qt5-qtwebengine","fixed_in":["5.15.3_git20220121-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"qt5-qtwebengine","fixed_in":["5.15.3_git20220121-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"qt5-qtwebengine","fixed_in":["5.15.3_git20220121-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"qt5-qtwebengine","fixed_in":["5.15.3_git20220121-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"qt5-qtwebengine","fixed_in":["5.15.3_git20220121-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"qt5-qtwebengine","fixed_in":["5.15.3_git20220121-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"qt5-qtwebengine","fixed_in":["5.15.3_git20220121-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"qt5-qtwebengine","fixed_in":["5.15.3_git20220121-r4"],"sources":["osv"]},{"ecosystem":"Android","package":"platform/external/expat","fixed_in":["10:2022-09-01","11:2022-09-01","12:2022-09-01","12L:2022-09-01"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"expat","fixed_in":["2.4.8-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"expat","fixed_in":["2.4.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.4.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.4.3-2"],"sources":["osv"]},{"ecosystem":"Julia","package":"Expat_jll","fixed_in":["2.4.4+0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"expat","fixed_in":["0:2.2.5-4.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"expat-debuginfo","fixed_in":["0:2.2.5-4.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"expat-debugsource","fixed_in":["0:2.2.5-4.el8_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"expat-devel","fixed_in":["0:2.2.5-4.el8_4.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","fixed_in":["2.1.0-4ubuntu1.4+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","fixed_in":["2.1.0-7ubuntu0.16.04.5+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"expat","fixed_in":["2.2.5-3ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"expat","fixed_in":["2.2.9-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"expat","fixed_in":["2.4.3-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"firefox","fixed_in":["1:1snap1-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3_git20211127-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3_git20220121-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3_git20220121-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3_git20220121-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3_git20220121-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3_git20220121-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3_git20220121-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3_git20220121-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"qt5-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.3_git20220121-r4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-8.el8_6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-8.el8_6.2"}]}],"bundled":12},{"source":"osv","ecosystem":"Android","package":"platform/external/expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-09-01"}]}],"versions":["10"]},{"source":"osv","ecosystem":"Android","package":"platform/external/expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-09-01"}]}],"versions":["11"]},{"source":"osv","ecosystem":"Android","package":"platform/external/expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-09-01"}]}],"versions":["12"]},{"source":"osv","ecosystem":"Android","package":"platform/external/expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-09-01"}]}],"versions":["12L"]},{"source":"osv","ecosystem":"Azure Linux:2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els1"}]}],"bundled":13},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els1"}]}],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els1"}]}],"bundled":13},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els1"}]}],"bundled":13},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4.1","1.2-4.1~exp1","1.2-4.2"]},{"source":"osv","ecosystem":"Debian:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-2+deb9u4"}]}],"versions":["2.2.0-2","2.2.0-2+deb9u1","2.2.0-2+deb9u2","2.2.0-2+deb9u3"],"bundled":10},{"source":"osv","ecosystem":"Debian:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-2+deb9u5"}]}],"versions":["2.2.0-2","2.2.0-2+deb9u1","2.2.0-2+deb9u2","2.2.0-2+deb9u3","2.2.0-2+deb9u4"],"bundled":5},{"source":"osv","ecosystem":"Debian:10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u2"}]}],"versions":["2.2.6-2","2.2.6-2+deb10u1"],"bundled":10},{"source":"osv","ecosystem":"Debian:11","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u1"}]}],"versions":["2.2.10-2"],"bundled":10},{"source":"osv","ecosystem":"Julia","package":"Expat_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-1.2.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-5.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-5.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-5.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-12.el9_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-12.el9_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-12.el9_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-12.el9_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-12.el9_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-12.el9_0"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_5.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_5.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_5.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_5.3"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-14.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::baseos","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_4.3"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-4.el8_5.3"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-88.42.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-88.42.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm4"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50-3","3.1.4~abc9f50-4","3.1.4~abc9f50-4ubuntu2","3.1.4~abc9f50-4ubuntu2+esm1","3.1.4~abc9f50-4ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37ubuntu5","4.1.1+xorg4.3.0-37ubuntu5.0.1","4.1.1+xorg4.3.0-37ubuntu5.0.2","4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14ubuntu1","5.8.0-14ubuntu3","5.8.0-14.1ubuntu2","5.8.0-14.1ubuntu3","5.8.0-14.1ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm2"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cableswig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0+git20150808-1","0.1.0+git20150808-2","0.1.0+git20150808-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"insighttoolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20.1+git20120521-6","3.20.1+git20120521-6build1","3.20.1+git20120521-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1ubuntu3","4.8.1-1ubuntu4","4.8.2-3.1ubuntu1","4.9.0-3ubuntu2","4.9.0-4ubuntu1","4.9.0-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2","4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.1+dfsg-2","5.10.1+dfsg-2build3","5.10.1+dfsg-2.1build1","5.10.1+dfsg-2.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.4"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-2","3.1.4~abc9f50+dfsg2-1","3.1.4~abc9f50+dfsg3-1","3.1.4~abc9f50+dfsg3-2","3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1","0.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.2"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.3-2"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1snap1-0ubuntu1"}]}],"versions":["93.0+build1-0ubuntu3","94.0+build3-0ubuntu1","94.0.2+build1-0ubuntu1","94.0.2+build2-0ubuntu1","95.0+build1-0ubuntu1","95.0.1+build2-0ubuntu1","95.0.2+build1-0ubuntu1","96.0+build2-0ubuntu1","96.0.1+build1-0ubuntu1","96.0.2+build1-0ubuntu1","96.0.3+build1-0ubuntu1","97.0+build1-0ubuntu1","97.0+build2-0ubuntu1","97.0.1+build1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1","0.11.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build3","2.4.7-6.1","2.4.7-6.1build1","2.4.7-6.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-9","1.33.14-10","1.33.14-10ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24+dfsg-2","0.24+dfsg-3","0.24+dfsg-3build1","0.24+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1","0.13+ds2-1build1","0.13+ds2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.3-1","0.9.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:115.3.1+build1-0ubuntu1","1:115.4.1+build1-0ubuntu1","1:115.4.3+build1-0ubuntu1","1:115.5.0+build1-0ubuntu1","1:115.5.1+build1-0ubuntu1","1:115.5.2+build2-0ubuntu1","1:115.6.0+build1-0ubuntu1","1:115.6.0+build2-0ubuntu1","1:115.6.1+build1-0ubuntu1","1:115.8.0+build1-0ubuntu1","1:115.8.1+build1+snap2","1:115.8.1+build1+snap3","2:1snap1-0ubuntu1","2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.8+dfsg-3","0.11.8+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.2","2.4.7-6.2build1","2.4.7-6.2build2","2.4.7-6.2build3","2.4.7-6.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-11","1.33.14-11.1","1.33.14-12","1.33.14-12build1","1.33.14-12build2","1.33.14-12ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.3","2.4.7-6.3build1","2.4.7-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-2","0.9.5.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-7","1.59.03-9","1.59.03-10","1.59.03-10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7.1","2.4.7-7.2","2.4.7-7.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-2","0.9.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-3","0.11.10+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.05-1","1.60.05-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2","0.28+dfsg-1","0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2","0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-3","0.9.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3","2:1snap1-0ubuntu4","2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2","0.11.10+dfsg-2build1","0.11.10+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-10.1","1.60.05-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7","2.4.7-7.1","2.4.7-7.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm4"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm2"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.4"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.2"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-1.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libexpat_project","product":"libexpat"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"oracle","product":"communications_metasolv_solution"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinema_remote_connect_server"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"tenable","product":"nessus"}],"references":[{"url":"https://github.com/libexpat/libexpat/pull/550","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","article","report"]},{"url":"https://www.debian.org/security/2022/dsa-5073","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://www.tenable.com/security/tns-2022-05","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220217-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"https://security.gentoo.org/glsa/202209-24","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-484086.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23852","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220217-0001"},{"url":"https://github.com/advisories/GHSA-h83g-c7g2-6r9h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-23852","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0951","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45960","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-46143","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22822","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22823","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22824","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22825","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22826","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22827","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23852","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25235","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25236","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25315","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044451","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044455","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044457","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044464","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044467","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044479","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044484","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044488","tags":["report"]},{"url":"https://bugzilla.redhat.com/2044613","tags":["report"]},{"url":"https://bugzilla.redhat.com/2056363","tags":["report"]},{"url":"https://bugzilla.redhat.com/2056366","tags":["report"]},{"url":"https://bugzilla.redhat.com/2056370","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-0951.html","tags":["advisory"]},{"url":"https://source.android.com/security/bulletin/2022-09-01","tags":["advisory"]},{"url":"https://android.googlesource.com/platform/external/expat/+/d6a09f1b7fb24dd03dc58e45062ad951a37ff8e3","tags":["fix"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-23852","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1660757175.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1660758476.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1660759632.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1660760528","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1660762248.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23852.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-23852","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0048.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29985","tags":["report"]},{"url":"https://www.debian.org/lts/security/2022/dla-2904","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1511","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23990","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2022:4046","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.0_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_4046.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044455","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46143","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/532","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044457","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22822","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/pull/539","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044464","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22823","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044467","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22824","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044479","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22825","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044484","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22826","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044488","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22827","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22827","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044613","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23852","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048356","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23990","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056366","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25235","tags":["advisory"]},{"url":"https://blog.hartwork.org/posts/expat-2-4-5-released/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056363","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25315","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25315","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056370","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0951.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45960","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45960","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/531","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25236","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1069","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1069.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:4834","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4834.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:0951","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220495-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1195054","tags":["report"]},{"url":"https://bugzilla.suse.com/1195217","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23990","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220498-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214884-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-23852","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5288-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-45960","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-46143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23990","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-25235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-25236","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2BCJZG2PLWMYBP7YS7O3T6NSE3AKSEBB/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0610","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-23852","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.","status":"published","published":"2022-01-24T01:06:50Z","modified":"2026-10-14T15:52:50.075Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:34:29.478363Z"}],"euvd":[{"id":"EUVD-2022-28778","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.","status":"published","published":"2022-01-24T01:06:50Z","modified":"2026-10-14T15:52:50Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:14.734034Z"}],"ghsa":[{"id":"GHSA-h83g-c7g2-6r9h","title":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for...","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.","status":"published","published":"2022-02-10T00:01:17Z","modified":"2026-10-14T18:31:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:13:26.734116Z"}],"nvd":[{"id":"CVE-2022-23852","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.","status":"published","published":"2022-01-24T02:15:06.733Z","modified":"2026-10-14T16:17:27.353Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:07:11.52734Z"}],"osv":[{"id":"ALPINE-CVE-2022-23852","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.","status":"published","published":"2022-01-24T02:15:06.733Z","modified":"2026-11-03T07:30:14.454986555Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-7835","title":"CVE-2022-23852 affecting package expat for versions less than 2.4.8-1","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.","status":"published","published":"2022-01-24T02:15:06Z","modified":"2026-04-21T04:34:25.14358Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:09.747541Z"},{"id":"BELL-CVE-2022-23852","title":"CVE-2022-23852 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:26.243342Z","modified":"2026-01-26T09:50:05.936317Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-23852","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.","status":"published","published":"2022-01-24T01:06:50Z","modified":"2026-10-28T02:31:03.137092932Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:24.428403Z"},{"id":"DEBIAN-CVE-2022-23852","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.","status":"published","published":"2022-01-24T02:15:06.733Z","modified":"2026-11-03T08:01:26.631013808Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"JLSEC-2025-50","title":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in `XML_GetBuffer`, for...","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in `XML_GetBuffer`, for configurations with a nonzero `XML_CONTEXT_BYTES`.","status":"published","published":"2025-10-14T15:35:41.198Z","modified":"2026-07-23T22:30:27.699147176Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2022-1511","title":"expat security update","description":"An XML parser library.\r\n\r\nSecurity Fix(es):\r\n\r\nExpat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.(CVE-2022-23852)\r\n\r\nExpat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.(CVE-2022-23990)","status":"published","published":"2022-02-11T11:04:47Z","modified":"2026-08-18T01:15:39.26154624Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"RHBA-2022:4046","title":"Red Hat Bug Fix Advisory: new packages: expat","status":"published","published":"2025-02-04T10:01:27Z","modified":"2026-10-15T10:02:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2022:0951","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-17T01:16:00Z","modified":"2026-10-15T10:02:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1069","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-17T01:16:40Z","modified":"2026-10-15T10:02:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:4834","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-16T07:26:00Z","modified":"2026-10-15T10:02:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:0951","title":"Important: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)\n\n* expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution (CVE-2022-25236)\n\n* expat: Integer overflow in storeRawNames() (CVE-2022-25315)\n\n* expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)\n\n* expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)\n\n* expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)\n\n* expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)\n\n* expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)\n\n* expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)\n\n* expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)\n\n* expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)\n\n* expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-03-16T15:13:06Z","modified":"2026-02-04T07:40:22.968789Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-23852","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.","status":"published","published":"2022-01-24T02:15:00Z","modified":"2026-10-17T12:55:57.142580979Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"ALSA-2022:0951","title":"Important: expat security update","description":"Expat is a C library for parsing XML documents.\nSecurity Fix(es):\n* expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)\n* expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution (CVE-2022-25236)\n* expat: Integer overflow in storeRawNames() (CVE-2022-25315)\n* expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)\n* expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)\n* expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)\n* expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)\n* expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)\n* expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)\n* expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)\n* expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)\n* expat: Integer overflow in function XML_GetBuffer (CVE-2022-23852)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-03-16T00:00:00Z","modified":"2026-10-29T11:01:15.158791294Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ASB-A-221255869","description":"In XML_GetBuffer of xmlparse.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2022-09-01T00:00:00Z","modified":"2026-11-10T17:02:23.040266809Z","updated_at":"2026-11-10T17:35:05.376141Z"},{"id":"CLSA-2022-1660757175","title":"Fixed 15 CVEs in expat","description":"- CVE-2022-25236: Fix insertion of namespace-separator characters into\n  namespace URIs\n- CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to\n  arbitrary code execution\n- CVE-2022-25315: Fix integer overflow in storeRawNames()\n- CVE-2022-22822: Fix integer overflow in addBinding()\n- CVE-2022-22823: Fix integer overflow in build_model()\n- CVE-2022-22824: Fix integer overflow in defineAttribute()\n- CVE-2022-22825: Fix integer overflow in lookup()\n- CVE-2022-22826: Fix integer overflow in nextScaffoldPart()\n- CVE-2022-22827: Fix integer overflow in storeAtts()\n- CVE-2022-23852: Fix integer overflow in XML_GetBuffer()\n- CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()\n- CVE-2021-45960: Fix troublesome left shifts in storeAtts()\n- CVE-2022-23990: Fix integer overflow in doProlog()\n- CVE-2022-25313: Fix stack exhaustion in build_model()\n- CVE-2022-25314: Fix integer overflow in copyString()","status":"published","published":"2022-08-17T17:26:15Z","modified":"2026-10-21T10:47:56.534771217Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660758476","title":"Fixed 15 CVEs in expat","description":"- CVE-2022-25236: Fix insertion of namespace-separator characters into\n  namespace URIs\n- CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to\n  arbitrary code execution\n- CVE-2022-25315: Fix integer overflow in storeRawNames()\n- CVE-2022-22822: Fix integer overflow in addBinding()\n- CVE-2022-22823: Fix integer overflow in build_model()\n- CVE-2022-22824: Fix integer overflow in defineAttribute()\n- CVE-2022-22825: Fix integer overflow in lookup()\n- CVE-2022-22826: Fix integer overflow in nextScaffoldPart()\n- CVE-2022-22827: Fix integer overflow in storeAtts()\n- CVE-2022-23852: Fix integer overflow in XML_GetBuffer()\n- CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()\n- CVE-2021-45960: Fix troublesome left shifts in storeAtts()\n- CVE-2022-23990: Fix integer overflow in doProlog()\n- CVE-2022-25313: Fix stack exhaustion in build_model()\n- CVE-2022-25314: Fix integer overflow in copyString()","status":"published","published":"2022-08-17T17:47:56Z","modified":"2026-10-21T10:47:51.665937197Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660759632","title":"Fixed 13 CVEs in expat","description":"- CVE-2022-25236: Fix insertion of namespace-separator characters into\n  namespace URIs\n- CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to\n  arbitrary code execution\n- CVE-2022-25315: Fix integer overflow in storeRawNames()\n- CVE-2022-22822: Fix integer overflow in addBinding()\n- CVE-2022-22823: Fix integer overflow in build_model()\n- CVE-2022-22824: Fix integer overflow in defineAttribute()\n- CVE-2022-22825: Fix integer overflow in lookup()\n- CVE-2022-22826: Fix integer overflow in nextScaffoldPart()\n- CVE-2022-22827: Fix integer overflow in storeAtts()\n- CVE-2022-23852: Fix integer overflow in XML_GetBuffer()\n- CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()\n- CVE-2021-45960: Fix troublesome left shifts in storeAtts()\n- CVE-2022-23990: Fix integer overflow in doProlog()","status":"published","published":"2022-08-17T18:07:12Z","modified":"2026-10-21T10:48:01.406135998Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660760528","title":"Fix CVE(s): CVE-2022-25235, CVE-2022-23990, CVE-2022-22825, CVE-2022-22824, CVE-2022-23852, CVE-2022-25315, CVE-2022-25236, CVE-2021-46143, CVE-2022-25313, CVE-2021-45960, CVE-2022-22826, CVE-2022-22827, CVE-2022-22822, CVE-2022-22823","description":"\n   * SECURITY UPDATE: Stack exhaustion\n     - debian/patches/CVE-2022-25313.patch: prevent\n       stack exhaustion in build_model in expat/lib/xmlparse.c.\n     - debian/patches/fix-build_model-regression.patch: fix build_model\n       regression in expat/lib/xmlparse.c.\n     - CVE-2022-25313\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2022-25315.patch: prevent integer overflow in\n       storeRawNames in expat/lib/xmlparse.c.\n     - CVE-2022-25315\n   * SECURITY UPDATE: relax fix to CVE-2022-25236 with regard to\n     RFC 3986 URI characters and possibly regressions\n     - debian/patches/CVE-2022-25236-3.patch: add a note on namespace URI\n       validation in expat/doc/reference.html, expat/lib/expat.h.\n     - debian/patches/CVE-2022-25236-4.patch: document namespace separator\n       effect right in header expat/lib/expat.h.\n     - debian/patches/CVE-2022-25236-5.patch: cover relaxed fix in tests.\n     - debian/patches/CVE-2022-25236-6.patch: relax fix with regard to\n       RFC 3986 URI characters in expat/lib/xmlparse.c. (LP: #1963903)\n   * fix tests adding XCS definition\n     - debian/patches/fix_test_xcs.patch: in tests/runtests.c.\n   * SECURITY UPDATE: Realloc misbehavior\n     - debian/patches/CVE-2021-45960.patch: detect and prevent troublesome\n       left shifts in function storeAtts in lib/xmlparse.c.\n     - CVE-2021-45960\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2021-46143.patch: prevent integer overflow\n       on m_groupSize in function doProlog in lib/xmlparse.c.\n     - CVE-2021-46143\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2022-22822-to-CVE-2022-22827.patch: prevent integer overflow\n       in multiple places in lib/xmlparse.c.\n     - CVE-2022-22822\n     - CVE-2022-22823\n     - CVE-2022-22824\n     - CVE-2022-22825\n     - CVE-2022-22826\n     - CVE-2022-22827\n   * SECURITY UPDATE: Signed integer overflow\n     - debian/patches/CVE-2022-23852-*.patch: detect and prevent\n       integer overflow in XML_GetBuffer in expat/lib/xmlparse.c and\n       adds test to cover it in tests/runtests.c.\n     - CVE-2022-23852\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2022-23990.patch: prevent integer overflow in\n       doProlog in lib/xmlparse.c.\n     - CVE-2022-23990\n   * SECURITY UPDATE: Incomplete validation encoding\n     - debian/patches/CVE-2022-25235-*.patch: adds missing validation\n       and adds tests in expat/lib/xmltok_impl.c, expat/tests/runtests.c.\n     - CVE-2022-25235\n   * SECURITY UPDATE: Namespace-separator insertions\n     - debian/patches/CVE-2022-25236-*.patch: Protect against malicious\n       namespace declarations in expat/lib/xmlparse.c, expat/tests/runtests.c.\n     - CVE-2022-25236\n   * debian/patches/fixing_tests.patch: fixing tests in order to it work\n     in xenial and oldest releases.","status":"published","published":"2022-08-17T18:22:08Z","modified":"2026-06-04T10:04:12.695059494Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660762248","title":"Fixed 13 CVEs in expat","description":"- CVE-2022-25236: Fix insertion of namespace-separator characters into\n  namespace URIs\n- CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to\n  arbitrary code execution\n- CVE-2022-25315: Fix integer overflow in storeRawNames()\n- CVE-2022-22822: Fix integer overflow in addBinding()\n- CVE-2022-22823: Fix integer overflow in build_model()\n- CVE-2022-22824: Fix integer overflow in defineAttribute()\n- CVE-2022-22825: Fix integer overflow in lookup()\n- CVE-2022-22826: Fix integer overflow in nextScaffoldPart()\n- CVE-2022-22827: Fix integer overflow in storeAtts()\n- CVE-2022-23852: Fix integer overflow in XML_GetBuffer()\n- CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()\n- CVE-2021-45960: Fix troublesome left shifts in storeAtts()\n- CVE-2022-23990: Fix integer overflow in doProlog()","status":"published","published":"2022-08-17T18:50:48Z","modified":"2026-10-21T10:47:13.304977424Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"DLA-2904-1","title":"expat - security update","status":"published","published":"2022-01-30T00:00:00Z","modified":"2026-03-09T01:18:56.856358Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DLA-2935-1","title":"expat - security update","status":"published","published":"2022-03-07T00:00:00Z","modified":"2026-03-09T01:19:47.091819Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5073-1","title":"expat - security update","status":"published","published":"2022-02-12T00:00:00Z","modified":"2026-03-09T02:09:22.806264Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0048","title":"Updated expat packages fix security vulnerability","description":"Expat (aka libexpat) before 2.4.4 has a signed integer overflow in\nXML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.\n(CVE-2022-23852)\n\nExpat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog\nfunction. (CVE-2022-23990)\n","status":"published","published":"2022-02-03T20:29:44Z","modified":"2026-04-16T04:42:12.903096305Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0498-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054).\n- CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217).\n","status":"published","published":"2022-02-18T09:47:12Z","modified":"2026-02-04T04:38:34.465537Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11793-1","title":"expat-2.4.4-1.1 on GA media","description":"These are all security issues fixed in the expat-2.4.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:03:11.085238Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11985-1","title":"libQt5Pdf5-5.15.9-1.1 on GA media","description":"These are all security issues fixed in the libQt5Pdf5-5.15.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:55:24.244663Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:0495-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054).\n- CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217).\n","status":"published","published":"2022-02-18T09:40:34Z","modified":"2026-02-04T04:20:40.411909Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0498-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054).\n- CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217).\n","status":"published","published":"2022-02-18T09:48:32Z","modified":"2026-02-04T04:34:28.005288Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:14884-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2022-23852: Fixed signed integer overflow in XML_GetBuffer (bsc#1195054).\n- CVE-2022-23990: Fixed integer overflow in the doProlog function (bsc#1195217).\n","status":"published","published":"2022-02-09T14:51:23Z","modified":"2026-02-04T03:00:51.591733Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5288-1","title":"expat vulnerabilities","description":"It was discovered that Expat incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a crash or\nexecute arbitrary code.\n","status":"published","published":"2022-02-21T14:48:40Z","modified":"2026-06-29T13:49:35.689531107Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}