{"id":"CVE-2022-25313","aliases":["ALPINE-CVE-2022-25313","ALSA-2022:5244","ALSA-2022:5314","ALSA-2022:7811","AZL-8623","BELL-CVE-2022-25313","CLSA-2022-1660757175","CLSA-2022-1660758476","CLSA-2022-1660760528","CLSA-2026-1776243051","DEBIAN-CVE-2022-25313","DLA-2935-1","DSA-5085-1","EUVD-2022-29996","GHSA-3gf2-723m-w3fv","JLSEC-2025-54","MGASA-2022-0081","MGASA-2026-0173","OESA-2022-1554","OESA-2022-2057","RHSA-2022:5244","RHSA-2022:5314","RHSA-2022:7811","RHSA-2025:22785","RHSA-2025:22871","RLSA-2022:5314","SUSE-SU-2022:0698-1","SUSE-SU-2022:0713-1","SUSE-SU-2022:14903-1","SUSE-SU-2022:2294-1","UBUNTU-CVE-2022-25313","USN-5320-1","openSUSE-SU-2022:0713-1","openSUSE-SU-2024:11866-1"],"status":"published","title":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via...","description":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03295,"percentile":0.8859,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-400","CWE-674"],"published":"2022-02-18T04:23:04Z","modified":"2026-11-03T08:02:45Z","exploits":[{"source":"pocgithub","id":"ShaikUsaf/external_expact_AOSP10_r33_CVE-2022-25313","title":"ShaikUsaf/external_expact_AOSP10_r33_CVE-2022-25313","date":"2022-05-11","url":"https://github.com/ShaikUsaf/external_expact_AOSP10_r33_CVE-2022-25313"},{"source":"pocgithub","id":"Trinadh465/external_expat-2.1.0_CVE-2022-25313","title":"Trinadh465/external_expat-2.1.0_CVE-2022-25313","date":"2023-04-12","url":"https://github.com/Trinadh465/external_expat-2.1.0_CVE-2022-25313"}],"fixes":[{"ecosystem":"Alpine:v3.12","package":"expat","fixed_in":["2.2.10-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"expat","fixed_in":["2.2.10-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"expat","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"expat","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"expat","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"expat","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"expat","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"expat","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"expat","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"expat","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"expat","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"expat","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"expat","fixed_in":["2.4.5-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"expat","fixed_in":["2.4.8-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"expat","fixed_in":["2.4.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.4.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.4.5-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Expat_jll","fixed_in":["2.4.8+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","fixed_in":["2.1.0-4ubuntu1.4+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","fixed_in":["2.1.0-7ubuntu0.16.04.5+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"expat","fixed_in":["2.2.5-3ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"expat","fixed_in":["2.2.9-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"firefox","fixed_in":["1:1snap1-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-12.el9_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-12.el9_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-8.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-8.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw32-expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mingw64-expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Azure Linux:2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.8-1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els1"}]}],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els1"}]}],"bundled":14},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.6.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.6.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.6.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4.1","1.2-4.1~exp1","1.2-4.2"]},{"source":"osv","ecosystem":"Debian:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-2+deb9u5"}]}],"versions":["2.2.0-2","2.2.0-2+deb9u1","2.2.0-2+deb9u2","2.2.0-2+deb9u3","2.2.0-2+deb9u4"],"bundled":5},{"source":"osv","ecosystem":"Debian:10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u3"}]}],"versions":["2.2.6-2","2.2.6-2+deb10u1","2.2.6-2+deb10u2"],"bundled":5},{"source":"osv","ecosystem":"Debian:11","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u2"}]}],"versions":["2.2.10-2","2.2.10-2+deb11u1"],"bundled":5},{"source":"osv","ecosystem":"Julia","package":"Expat_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.8+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-1.3.mga8"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:9","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51.08-1.1.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-6.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-6.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-6.oe1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-8.oe2203"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-12.el9_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-12.el9_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-12.el9_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-12.el9_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-12.el9_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-12.el9_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-8.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-8.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-8.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-8.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw-expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw32-expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"mingw64-expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.8-1.el8"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_2"}]}],"bundled":18},{"source":"osv","ecosystem":"Rocky Linux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-8.el8_6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-88.42.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-88.42.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.6.9"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.6.9"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm6"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50-3","3.1.4~abc9f50-4","3.1.4~abc9f50-4ubuntu2","3.1.4~abc9f50-4ubuntu2+esm1","3.1.4~abc9f50-4ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37ubuntu5","4.1.1+xorg4.3.0-37ubuntu5.0.1","4.1.1+xorg4.3.0-37ubuntu5.0.2","4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14ubuntu1","5.8.0-14ubuntu3","5.8.0-14.1ubuntu2","5.8.0-14.1ubuntu3","5.8.0-14.1ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.33-3.2ubuntu3","1.33.06-0ubuntu1","1.33.06-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm5"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ayttm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.3-3build1","0.6.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cableswig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0+git20150808-1","0.1.0+git20150808-2","0.1.0+git20150808-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"insighttoolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20.1+git20120521-6","3.20.1+git20120521-6build1","3.20.1+git20120521-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1ubuntu3","4.8.1-1ubuntu4","4.8.2-3.1ubuntu1","4.9.0-3ubuntu2","4.9.0-4ubuntu1","4.9.0-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-4","2.4.7-4build1","2.4.7-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2","4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.1+dfsg-2","5.10.1+dfsg-2build3","5.10.1+dfsg-2.1build1","5.10.1+dfsg-2.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-0.2ubuntu3","1.33.14-1ubuntu1","1.33.14-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.7"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-2","3.1.4~abc9f50+dfsg2-1","3.1.4~abc9f50+dfsg3-1","3.1.4~abc9f50+dfsg3-2","3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5build1","0.13+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-5ubuntu1","2.4.7-5ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1","0.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-7","1.33.14-8","1.33.14-8build1","1.33.14-8ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.4"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-6","0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build1","2.4.7-6build2","2.4.7-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-8build1","1.33.14-8build2","1.33.14-8ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1snap1-0ubuntu1"}]}],"versions":["93.0+build1-0ubuntu3","94.0+build3-0ubuntu1","94.0.2+build1-0ubuntu1","94.0.2+build2-0ubuntu1","95.0+build1-0ubuntu1","95.0.1+build2-0ubuntu1","95.0.2+build1-0ubuntu1","96.0+build2-0ubuntu1","96.0.1+build1-0ubuntu1","96.0.2+build1-0ubuntu1","96.0.3+build1-0ubuntu1","97.0+build1-0ubuntu1","97.0+build2-0ubuntu1","97.0.1+build1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1","0.11.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build3","2.4.7-6.1","2.4.7-6.1build1","2.4.7-6.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-9","1.33.14-10","1.33.14-10ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24+dfsg-2","0.24+dfsg-3","0.24+dfsg-3build1","0.24+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1","0.13+ds2-1build1","0.13+ds2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.3-1","0.9.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:115.3.1+build1-0ubuntu1","1:115.4.1+build1-0ubuntu1","1:115.4.3+build1-0ubuntu1","1:115.5.0+build1-0ubuntu1","1:115.5.1+build1-0ubuntu1","1:115.5.2+build2-0ubuntu1","1:115.6.0+build1-0ubuntu1","1:115.6.0+build2-0ubuntu1","1:115.6.1+build1-0ubuntu1","1:115.8.0+build1-0ubuntu1","1:115.8.1+build1+snap2","1:115.8.1+build1+snap3","2:1snap1-0ubuntu1","2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.8+dfsg-3","0.11.8+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.2","2.4.7-6.2build1","2.4.7-6.2build2","2.4.7-6.2build3","2.4.7-6.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-11","1.33.14-11.1","1.33.14-12","1.33.14-12build1","1.33.14-12build2","1.33.14-12ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.3","2.4.7-6.3build1","2.4.7-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-2","0.9.5.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-7","1.59.03-9","1.59.03-10","1.59.03-10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7.1","2.4.7-7.2","2.4.7-7.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-2","0.9.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-3","0.11.10+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.05-1","1.60.05-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2","0.28+dfsg-1","0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2","0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-3","0.9.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3","2:1snap1-0ubuntu4","2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2","0.11.10+dfsg-2build1","0.11.10+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-10.1","1.60.05-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7","2.4.7-7.1","2.4.7-7.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm6"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm5"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.7"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.4"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-1.1"}]}],"bundled":5}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libexpat_project","product":"libexpat"},{"vendor":"oracle","product":"http_server"},{"vendor":"oracle","product":"zfs_storage_appliance_kit"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinema_remote_connect_server"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://github.com/libexpat/libexpat/pull/558","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","fix","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2022/02/19/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://www.debian.org/security/2022/dsa-5085","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","article","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220303-0008/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"https://security.gentoo.org/glsa/202209-24","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-484086.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25313","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM"},{"url":"https://security.netapp.com/advisory/ntap-20220303-0008"},{"url":"https://github.com/advisories/GHSA-3gf2-723m-w3fv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-25313","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5244","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25313","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25314","tags":["report"]},{"url":"https://bugzilla.redhat.com/2056350","tags":["report"]},{"url":"https://bugzilla.redhat.com/2056354","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-5244.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5314","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-5314.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:7811","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23990","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25235","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25236","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25315","tags":["report"]},{"url":"https://bugzilla.redhat.com/2048356","tags":["report"]},{"url":"https://bugzilla.redhat.com/2056363","tags":["report"]},{"url":"https://bugzilla.redhat.com/2056366","tags":["report"]},{"url":"https://bugzilla.redhat.com/2056370","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-7811.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-25313","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1660757175.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1660758476.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1660760528","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1776243051.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25313.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-25313","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0081.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30070","tags":["report"]},{"url":"https://seclists.org/oss-sec/2022/q1/150","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5288-1","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0173.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31123","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1554","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25236","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25314","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25315","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2057","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056354","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5244.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25313","tags":["advisory","report"]},{"url":"https://blog.hartwork.org/posts/expat-2-4-5-released/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25314","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5314.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056370","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7811.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23990","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25235","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25236","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25315","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22785","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1000109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044457","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044488","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2310137","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2395108","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22785.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0340","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0340","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45960","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45960","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45960","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/531","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-46143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46143","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/532","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22822","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22822","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/pull/539","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22823","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22823","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22824","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22824","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22825","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22825","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22826","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22826","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22827","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22827","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22827","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43680","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43680","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/649","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-52425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52425","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52425","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-8176","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-8176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8176","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/893","tags":["article"]},{"url":"https://github.com/libexpat/libexpat/pull/973","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59375","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2025-59375","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2025-59375","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22871","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1752592","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22871.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20843","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20843","tags":["advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15903","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15903","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:5314","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220698-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196025","tags":["report"]},{"url":"https://bugzilla.suse.com/1196026","tags":["report"]},{"url":"https://bugzilla.suse.com/1196168","tags":["report"]},{"url":"https://bugzilla.suse.com/1196169","tags":["report"]},{"url":"https://bugzilla.suse.com/1196171","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-25235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-25236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-25313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-25314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-25315","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220713-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214903-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222294-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-25313","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5320-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-25314","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-25315","tags":["report"]},{"url":"https://launchpad.net/bugs/1963903","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6H3EOIG3ASUYP7RIHFPOJG3PFJYN54WT/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-25313","description":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.","status":"published","published":"2022-02-18T04:23:04Z","modified":"2026-10-14T16:11:10.646Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:34:28.374916Z"}],"euvd":[{"id":"EUVD-2022-29996","description":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.","status":"published","published":"2022-02-18T04:23:04Z","modified":"2026-10-14T16:11:10Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:14.304159Z"}],"ghsa":[{"id":"GHSA-3gf2-723m-w3fv","title":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via...","description":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.","status":"published","published":"2022-02-19T00:01:37Z","modified":"2026-10-14T18:31:27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-674"],"updated_at":"2026-11-02T15:13:26.734116Z"}],"nvd":[{"id":"CVE-2022-25313","description":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.","status":"published","published":"2022-02-18T05:15:08.13Z","modified":"2026-10-14T17:17:34.427Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:07:12.155838Z"}],"osv":[{"id":"ALPINE-CVE-2022-25313","description":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.","status":"published","published":"2022-02-18T05:15:08.13Z","modified":"2026-11-03T07:18:33.130507297Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"AZL-8623","title":"CVE-2022-25313 affecting package expat for versions less than 2.4.8-1","description":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.","status":"published","published":"2022-02-18T05:15:08Z","modified":"2026-04-21T04:34:52.868132Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:10.677811Z"},{"id":"BELL-CVE-2022-25313","title":"CVE-2022-25313 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:38.86086Z","modified":"2026-01-26T09:47:15.872069Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-25313","description":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.","status":"published","published":"2022-02-18T04:23:04Z","modified":"2026-10-28T02:30:34.683327812Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"DEBIAN-CVE-2022-25313","description":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.","status":"published","published":"2022-02-18T05:15:08.13Z","modified":"2026-11-03T08:02:45.60597466Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"JLSEC-2025-54","title":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in `build_model` via...","description":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in `build_model` via a large nesting depth in the DTD element.","status":"published","published":"2025-10-14T15:35:41.198Z","modified":"2026-07-25T18:23:43.187950801Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2022-1554","title":"expat security update","description":"An XML parser library.\r\n\r\nSecurity Fix(es):\r\n\r\nxmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.(CVE-2022-25235)\r\n\r\nxmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.(CVE-2022-25236)\r\n\r\nIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.(CVE-2022-25314)\r\n\r\nIn Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.(CVE-2022-25313)\r\n\r\nIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.(CVE-2022-25315)","status":"published","published":"2022-03-07T11:04:50Z","modified":"2026-08-18T01:16:26.053129759Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"OESA-2022-2057","title":"expat security update","description":"This package provides with static libraries and  header files for developing with expat.\r\n\r\nSecurity Fix(es):\r\n\r\nxmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.(CVE-2022-25235)\r\n\r\nxmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.(CVE-2022-25236)\r\n\r\nIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.(CVE-2022-25314)\r\n\r\nIn Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.(CVE-2022-25313)\r\n\r\nIn Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.(CVE-2022-25315)","status":"published","published":"2022-11-11T11:05:22Z","modified":"2026-08-18T01:17:21.57878549Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2022:5244","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-13T23:18:50Z","modified":"2026-10-09T10:04:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:5314","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-13T23:18:43Z","modified":"2026-10-09T10:04:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:7811","title":"Red Hat Security Advisory: mingw-expat security update","status":"published","published":"2024-09-17T01:17:12Z","modified":"2026-10-15T10:03:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2025:22785","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-12-05T10:08:28Z","modified":"2026-10-15T10:10:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:22871","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-12-09T10:06:09Z","modified":"2026-10-15T10:10:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RLSA-2022:5314","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* expat: stack exhaustion in doctype parsing (CVE-2022-25313)\n\n* expat: integer overflow in copyString() (CVE-2022-25314)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-06-28T10:52:05Z","modified":"2026-02-04T10:30:04.9177Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-25313","description":"In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.","status":"published","published":"2022-02-18T05:15:00Z","modified":"2026-10-17T12:56:02.416694444Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"ALSA-2022:5244","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.\nSecurity Fix(es):\n* expat: stack exhaustion in doctype parsing (CVE-2022-25313)\n* expat: integer overflow in copyString() (CVE-2022-25314)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-07-01T00:00:00Z","modified":"2026-10-29T11:31:03.76099348Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2022:5314","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.\nSecurity Fix(es):\n* expat: stack exhaustion in doctype parsing (CVE-2022-25313)\n* expat: integer overflow in copyString() (CVE-2022-25314)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2022-06-30T00:00:00Z","modified":"2026-10-29T11:01:04.843860483Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2022:7811","title":"Important: mingw-expat security update","description":"Expat is a C library for parsing XML documents. The mingw-expat packages provide a port of the Expat library for MinGW. \n\nThe following packages have been upgraded to a later upstream version: mingw-expat (2.4.8). (BZ#2057023, BZ#2057037, BZ#2057127)\n\nSecurity Fix(es):\n\n* expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)\n* expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution (CVE-2022-25236)\n* expat: Integer overflow in storeRawNames() (CVE-2022-25315)\n* expat: Stack exhaustion in doctype parsing (CVE-2022-25313)\n* expat: Integer overflow in copyString() (CVE-2022-25314)\n* expat: Integer overflow in the doProlog function (CVE-2022-23990)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-11-08T00:00:00Z","modified":"2026-10-29T11:01:52.78748159Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"CLSA-2022-1660757175","title":"Fixed 15 CVEs in expat","description":"- CVE-2022-25236: Fix insertion of namespace-separator characters into\n  namespace URIs\n- CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to\n  arbitrary code execution\n- CVE-2022-25315: Fix integer overflow in storeRawNames()\n- CVE-2022-22822: Fix integer overflow in addBinding()\n- CVE-2022-22823: Fix integer overflow in build_model()\n- CVE-2022-22824: Fix integer overflow in defineAttribute()\n- CVE-2022-22825: Fix integer overflow in lookup()\n- CVE-2022-22826: Fix integer overflow in nextScaffoldPart()\n- CVE-2022-22827: Fix integer overflow in storeAtts()\n- CVE-2022-23852: Fix integer overflow in XML_GetBuffer()\n- CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()\n- CVE-2021-45960: Fix troublesome left shifts in storeAtts()\n- CVE-2022-23990: Fix integer overflow in doProlog()\n- CVE-2022-25313: Fix stack exhaustion in build_model()\n- CVE-2022-25314: Fix integer overflow in copyString()","status":"published","published":"2022-08-17T17:26:15Z","modified":"2026-10-21T10:47:56.534771217Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660758476","title":"Fixed 15 CVEs in expat","description":"- CVE-2022-25236: Fix insertion of namespace-separator characters into\n  namespace URIs\n- CVE-2022-25235: Fix malformed UTF-8 sequences which can lead to\n  arbitrary code execution\n- CVE-2022-25315: Fix integer overflow in storeRawNames()\n- CVE-2022-22822: Fix integer overflow in addBinding()\n- CVE-2022-22823: Fix integer overflow in build_model()\n- CVE-2022-22824: Fix integer overflow in defineAttribute()\n- CVE-2022-22825: Fix integer overflow in lookup()\n- CVE-2022-22826: Fix integer overflow in nextScaffoldPart()\n- CVE-2022-22827: Fix integer overflow in storeAtts()\n- CVE-2022-23852: Fix integer overflow in XML_GetBuffer()\n- CVE-2021-46143: Fix integer overflow on m_groupSize in doProlog()\n- CVE-2021-45960: Fix troublesome left shifts in storeAtts()\n- CVE-2022-23990: Fix integer overflow in doProlog()\n- CVE-2022-25313: Fix stack exhaustion in build_model()\n- CVE-2022-25314: Fix integer overflow in copyString()","status":"published","published":"2022-08-17T17:47:56Z","modified":"2026-10-21T10:47:51.665937197Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1660760528","title":"Fix CVE(s): CVE-2022-25235, CVE-2022-23990, CVE-2022-22825, CVE-2022-22824, CVE-2022-23852, CVE-2022-25315, CVE-2022-25236, CVE-2021-46143, CVE-2022-25313, CVE-2021-45960, CVE-2022-22826, CVE-2022-22827, CVE-2022-22822, CVE-2022-22823","description":"\n   * SECURITY UPDATE: Stack exhaustion\n     - debian/patches/CVE-2022-25313.patch: prevent\n       stack exhaustion in build_model in expat/lib/xmlparse.c.\n     - debian/patches/fix-build_model-regression.patch: fix build_model\n       regression in expat/lib/xmlparse.c.\n     - CVE-2022-25313\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2022-25315.patch: prevent integer overflow in\n       storeRawNames in expat/lib/xmlparse.c.\n     - CVE-2022-25315\n   * SECURITY UPDATE: relax fix to CVE-2022-25236 with regard to\n     RFC 3986 URI characters and possibly regressions\n     - debian/patches/CVE-2022-25236-3.patch: add a note on namespace URI\n       validation in expat/doc/reference.html, expat/lib/expat.h.\n     - debian/patches/CVE-2022-25236-4.patch: document namespace separator\n       effect right in header expat/lib/expat.h.\n     - debian/patches/CVE-2022-25236-5.patch: cover relaxed fix in tests.\n     - debian/patches/CVE-2022-25236-6.patch: relax fix with regard to\n       RFC 3986 URI characters in expat/lib/xmlparse.c. (LP: #1963903)\n   * fix tests adding XCS definition\n     - debian/patches/fix_test_xcs.patch: in tests/runtests.c.\n   * SECURITY UPDATE: Realloc misbehavior\n     - debian/patches/CVE-2021-45960.patch: detect and prevent troublesome\n       left shifts in function storeAtts in lib/xmlparse.c.\n     - CVE-2021-45960\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2021-46143.patch: prevent integer overflow\n       on m_groupSize in function doProlog in lib/xmlparse.c.\n     - CVE-2021-46143\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2022-22822-to-CVE-2022-22827.patch: prevent integer overflow\n       in multiple places in lib/xmlparse.c.\n     - CVE-2022-22822\n     - CVE-2022-22823\n     - CVE-2022-22824\n     - CVE-2022-22825\n     - CVE-2022-22826\n     - CVE-2022-22827\n   * SECURITY UPDATE: Signed integer overflow\n     - debian/patches/CVE-2022-23852-*.patch: detect and prevent\n       integer overflow in XML_GetBuffer in expat/lib/xmlparse.c and\n       adds test to cover it in tests/runtests.c.\n     - CVE-2022-23852\n   * SECURITY UPDATE: Integer overflow\n     - debian/patches/CVE-2022-23990.patch: prevent integer overflow in\n       doProlog in lib/xmlparse.c.\n     - CVE-2022-23990\n   * SECURITY UPDATE: Incomplete validation encoding\n     - debian/patches/CVE-2022-25235-*.patch: adds missing validation\n       and adds tests in expat/lib/xmltok_impl.c, expat/tests/runtests.c.\n     - CVE-2022-25235\n   * SECURITY UPDATE: Namespace-separator insertions\n     - debian/patches/CVE-2022-25236-*.patch: Protect against malicious\n       namespace declarations in expat/lib/xmlparse.c, expat/tests/runtests.c.\n     - CVE-2022-25236\n   * debian/patches/fixing_tests.patch: fixing tests in order to it work\n     in xenial and oldest releases.","status":"published","published":"2022-08-17T18:22:08Z","modified":"2026-06-04T10:04:12.695059494Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2026-1776243051","title":"expat: Fix of 2 CVEs","description":"- CVE-2022-25313: prevent stack exhaustion in build_model\n- CVE-2024-50602: make XML_StopParser refuse to stop/suspend an unstarted parser","status":"published","published":"2026-04-16T14:43:01Z","modified":"2026-06-01T00:33:18.327434698Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"DLA-2935-1","title":"expat - security update","status":"published","published":"2022-03-07T00:00:00Z","modified":"2026-03-09T01:19:47.091819Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5085-1","title":"expat - security update","status":"published","published":"2022-02-22T00:00:00Z","modified":"2026-03-09T02:11:45.335469Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0081","title":"Updated expat packages fix security vulnerability","description":"Passing malformed 2- and 3-byte UTF-8 sequences (e.g. from start tag names)\nto the XML processing application on top of Expat can cause arbitrary\ndamage (e.g. code execution) depending on how invalid UTF-8 is handled\ninside the XML processor; validation was not their job but Expat's.\nExploits with code execution are known to exist. (CVE-2022-25235)\n\nPassing (one or more) namespace separator characters in \"xmlns[:prefix]\"\nattribute values made Expat send malformed tag names to the XML processor\non top of Expat which can cause arbitrary damage (e.g. code execution)\ndepending on such unexpectable cases are handled inside the XML processor;\nvalidation was not their job but Expat's. Exploits with code execution\nare known to exist. (CVE-2022-25236)\n\nFix stack exhaustion in doctype parsing that could be triggered by e.g. a\n2 megabytes file with a large number of opening braces. Expected impact\nis denial of service or potentially arbitrary code execution.\n(CVE-2022-25313)\n\nFix integer overflow in function copyString;  only affects the encoding\nname parameter at parser creation time which is often hardcoded (rather\nthan user input), takes a value in the gigabytes to trigger, and a 64-bit\nmachine.  Expected impact is denial of service. (CVE-2022-25314)\n\nFix integer overflow in function storeRawNames; needs input in the\ngigabytes and a 64-bit machine. Expected impact is denial of service or\npotentially arbitrary code execution. (CVE-2022-25315)\n","status":"published","published":"2022-02-22T20:15:16Z","modified":"2026-04-16T04:43:59.577580576Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"MGASA-2026-0173","title":"Updated xmlrpc-c packages fix security vulnerabilities","description":"This update fixes the vulnerabilities by no longer building with the\nvulnerable bundled libexpat version.\n","status":"published","published":"2026-06-05T17:37:45Z","modified":"2026-06-05T17:45:08.885986445Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2022:0713-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n  \n- CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).\n- CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).\n- CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).\n- CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).\n- CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).\n","status":"published","published":"2022-03-04T08:34:34Z","modified":"2026-02-04T03:02:36.191452Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11866-1","title":"expat-2.4.6-1.1 on GA media","description":"These are all security issues fixed in the expat-2.4.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:32:38.215859Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:0698-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).\n- CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).\n- CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).\n- CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).\n- CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).\n","status":"published","published":"2022-03-03T15:35:39Z","modified":"2026-02-04T04:29:43.782661Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0713-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n  \n- CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).\n- CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).\n- CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).\n- CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).\n- CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).\n","status":"published","published":"2022-03-04T08:35:53Z","modified":"2026-02-04T04:03:01.084842Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:14903-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).\n- CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).\n- CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).\n- CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).\n- CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).\n","status":"published","published":"2022-03-04T08:36:45Z","modified":"2026-02-04T03:42:45.60431Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2294-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2022-25236: Fixed possible namespace-separator characters insertion into namespace URIs (bsc#1196025).\n- Fixed a regression caused by the patch for CVE-2022-25236 (bsc#1196784).\n- CVE-2022-25235: Fixed UTF-8 character validation in a certain context (bsc#1196026).\n- CVE-2022-25313: Fixed stack exhaustion in build_model() via uncontrolled recursion (bsc#1196168).\n- CVE-2022-25314: Fixed integer overflow in copyString (bsc#1196169).\n- CVE-2022-25315: Fixed integer overflow in storeRawNames (bsc#1196171).\n","status":"published","published":"2022-07-06T11:34:18Z","modified":"2025-05-02T04:32:54.702559Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5320-1","title":"expat vulnerabilities and regression","description":"USN-5288-1 fixed several vulnerabilities in Expat. For CVE-2022-25236 it\ncaused a regression and an additional patch was required. This update address\nthis regression and several other vulnerabilities.\n\nIt was discovered that Expat incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2022-25313)\n\nIt was discovered that Expat incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a crash\nor execute arbitrary code. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-25314)\n\nIt was discovered that Expat incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a crash or execute\narbitrary code. (CVE-2022-25315)\n\nOriginal advisory details:\n\n It was discovered that Expat incorrectly handled certain files.\n An attacker could possibly use this issue to cause a crash or\n execute arbitrary code. (CVE-2022-25236)\n","status":"published","published":"2022-03-10T13:19:12Z","modified":"2026-06-29T13:49:35.771910301Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}