{"id":"CVE-2022-43680","aliases":["A-255449293","ALPINE-CVE-2022-43680","ALSA-2023:0103","ALSA-2023:0337","ASB-A-255449293","AZL-11316","BELL-CVE-2022-43680","CLSA-2022-1667412057","CLSA-2022-1667412749","CLSA-2022-1667493762","CLSA-2022-1667494718","CLSA-2022-1667495485","CLSA-2023-1696877712","DEBIAN-CVE-2022-43680","DLA-3165-1","DSA-5266-1","EUVD-2022-46673","GHSA-4hjv-8mmr-jxwv","JLSEC-2025-58","MGASA-2022-0409","MGASA-2022-0427","MGASA-2026-0173","OESA-2022-2037","RHSA-2022:8548","RHSA-2022:8549","RHSA-2022:8550","RHSA-2022:8553","RHSA-2022:8554","RHSA-2023:0103","RHSA-2023:0337","RHSA-2024:0421","RHSA-2025:22785","RHSA-2025:22871","RLSA-2023:0103","RLSA-2023:0337","SUSE-SU-2022:3874-1","SUSE-SU-2022:3884-1","SUSE-SU-2022:3912-1","SUSE-SU-2026:24323-1","SUSE-SU-2026:4615-1","SUSE-SU-2026:4623-1","UBUNTU-CVE-2022-43680","USN-5638-2","USN-5638-3","USN-5638-4","openSUSE-SU-2024:12449-1"],"status":"published","title":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared...","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.03203,"percentile":0.88308,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-416"],"published":"2022-10-24T00:00:00Z","modified":"2026-11-05T16:32:28Z","exploits":[{"source":"pocgithub","id":"Trinadh465/external_expat-2.1.0_CVE-2022-43680","title":"Trinadh465/external_expat-2.1.0_CVE-2022-43680","date":"2022-12-15","url":"https://github.com/Trinadh465/external_expat-2.1.0_CVE-2022-43680"},{"source":"pocgithub","id":"nidhihcl/external_expat_2.1.0_CVE-2022-43680","title":"nidhihcl/external_expat_2.1.0_CVE-2022-43680","date":"2022-12-19","url":"https://github.com/nidhihcl/external_expat_2.1.0_CVE-2022-43680"}],"fixes":[{"ecosystem":"Alpine:v3.13","package":"expat","fixed_in":["2.2.10-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"expat","fixed_in":["2.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"expat","fixed_in":["2.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"expat","fixed_in":["2.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"expat","fixed_in":["2.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"expat","fixed_in":["2.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"expat","fixed_in":["2.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"expat","fixed_in":["2.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"expat","fixed_in":["2.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"expat","fixed_in":["2.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"expat","fixed_in":["2.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"expat","fixed_in":["2.5.0-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"expat","fixed_in":["2.2.5-10.el8_7.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"expat-devel","fixed_in":["2.2.5-10.el8_7.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"expat","fixed_in":["2.4.9-1.el9_1.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"expat-devel","fixed_in":["2.4.9-1.el9_1.1"],"sources":["osv"]},{"ecosystem":"Android","package":"platform/external/expat","fixed_in":["10:2023-02-01","11:2023-02-01","12:2023-02-01","12L:2023-02-01","13:2023-02-01"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"expat","fixed_in":["2.5.0-1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"expat","fixed_in":["2.0.1-13.el6_8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"expat-devel","fixed_in":["2.0.1-13.el6_8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"expat","fixed_in":["2.1.0-7ubuntu0.16.04.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1","fixed_in":["2.1.0-7ubuntu0.16.04.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1-dev","fixed_in":["2.1.0-7ubuntu0.16.04.5+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"expat","fixed_in":["2.0.1-13.el6_8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"expat-devel","fixed_in":["2.0.1-13.el6_8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"expat","fixed_in":["2.2.5-4.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"expat-devel","fixed_in":["2.2.5-4.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"expat-static","fixed_in":["2.2.5-4.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"expat","fixed_in":["2.2.5-4.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"expat-devel","fixed_in":["2.2.5-4.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"expat-static","fixed_in":["2.2.5-4.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"expat","fixed_in":["2.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"expat","fixed_in":["2.2.6-2+deb10u6"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"expat","fixed_in":["2.2.10-2+deb11u5"],"sources":["osv"]},{"ecosystem":"Julia","package":"Expat_jll","fixed_in":["2.5.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"expat","fixed_in":["2.2.10-1.6.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"expat","fixed_in":["2.2.9-9.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"expat","fixed_in":["2.2.9-9.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"expat","fixed_in":["2.4.1-8.oe2203"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat","fixed_in":["0:2.2.5-10.el8_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debuginfo","fixed_in":["0:2.2.5-10.el8_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debugsource","fixed_in":["0:2.2.5-10.el8_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-devel","fixed_in":["0:2.2.5-10.el8_7.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debuginfo","fixed_in":["0:2.4.9-1.el9_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debugsource","fixed_in":["0:2.4.9-1.el9_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-devel","fixed_in":["0:2.4.9-1.el9_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat","fixed_in":["0:2.4.9-1.el9_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debuginfo","fixed_in":["0:2.4.9-1.el9_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debugsource","fixed_in":["0:2.4.9-1.el9_1.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"expat","fixed_in":["0:2.2.5-8.el8_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"expat-debuginfo","fixed_in":["0:2.2.5-8.el8_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"expat-debugsource","fixed_in":["0:2.2.5-8.el8_6.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"expat-devel","fixed_in":["0:2.2.5-8.el8_6.4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"expat","fixed_in":["0:2.2.5-10.el8_7.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"expat","fixed_in":["0:2.4.9-1.el9_1.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"expat","fixed_in":["2.1.0-21.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"expat","fixed_in":["2.1.0-21.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"expat","fixed_in":["2.1.0-21.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"expat","fixed_in":["2.1.0-21.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"expat","fixed_in":["2.1.0-21.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"expat","fixed_in":["2.1.0-21.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"expat","fixed_in":["2.1.0-21.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"expat","fixed_in":["2.1.0-21.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"expat","fixed_in":["2.1.0-21.28.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"expat","fixed_in":["2.4.4-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"expat","fixed_in":["2.4.4-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"expat","fixed_in":["2.4.4-150400.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.2","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"expat","fixed_in":["2.2.5-150000.3.25.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","fixed_in":["2.1.0-4ubuntu1.4+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","fixed_in":["2.1.0-7ubuntu0.16.04.5+esm7"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"expat","fixed_in":["2.2.5-3ubuntu0.8","2.2.5-3ubuntu0.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"expat","fixed_in":["2.2.9-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"expat","fixed_in":["2.4.7-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"expat","fixed_in":["2.5.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-10.el8_7.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-10.el8_7.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1.el9_1.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1.el9_1.1"}]}]},{"source":"osv","ecosystem":"Android","package":"platform/external/expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2023-02-01"}]}],"versions":["10"]},{"source":"osv","ecosystem":"Android","package":"platform/external/expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2023-02-01"}]}],"versions":["11"]},{"source":"osv","ecosystem":"Android","package":"platform/external/expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2023-02-01"}]}],"versions":["12"]},{"source":"osv","ecosystem":"Android","package":"platform/external/expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2023-02-01"}]}],"versions":["12L"]},{"source":"osv","ecosystem":"Android","package":"platform/external/expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2023-02-01"}]}],"versions":["13"]},{"source":"osv","ecosystem":"Azure Linux:2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-13.el6_8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-4.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4.1","1.2-4.1~exp1","1.2-4.2"]},{"source":"osv","ecosystem":"Debian:10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u6"}]}],"versions":["2.2.6-2","2.2.6-2+deb10u1","2.2.6-2+deb10u2","2.2.6-2+deb10u3","2.2.6-2+deb10u4","2.2.6-2+deb10u5"]},{"source":"osv","ecosystem":"Debian:11","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u5"}]}],"versions":["2.2.10-2","2.2.10-2+deb11u1","2.2.10-2+deb11u2","2.2.10-2+deb11u3","2.2.10-2+deb11u4"]},{"source":"osv","ecosystem":"Julia","package":"Expat_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-1.6.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.5.0-1.mga8"}]}],"bundled":14},{"source":"osv","ecosystem":"Mageia:8","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.5.0-1.mga8"}]}],"bundled":14},{"source":"osv","ecosystem":"Mageia:8","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.85.0-1.mga8"}]}],"bundled":14},{"source":"osv","ecosystem":"Mageia:9","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51.08-1.1.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-9.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-9.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-8.oe2203"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_6"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_6"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_6"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_4"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_4"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.4::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_4"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_2"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.1::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:102.5.0-1.el8_7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-10.el8_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-10.el8_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-10.el8_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-10.el8_7.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-1.el9_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-1.el9_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-1.el9_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-1.el9_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-1.el9_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-1.el9_1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-8.el8_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-8.el8_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-8.el8_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-8.el8_6.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_2"}]}],"bundled":18},{"source":"osv","ecosystem":"Rocky Linux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-10.el8_7.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-1.el9_1.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-159998.1.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-21.55.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-21.55.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm7"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4","2.1.0-4ubuntu1.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50-3","3.1.4~abc9f50-4","3.1.4~abc9f50-4ubuntu2","3.1.4~abc9f50-4ubuntu2+esm1","3.1.4~abc9f50-4ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37ubuntu5","4.1.1+xorg4.3.0-37ubuntu5.0.1","4.1.1+xorg4.3.0-37ubuntu5.0.2","4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14ubuntu1","5.8.0-14ubuntu3","5.8.0-14.1ubuntu2","5.8.0-14.1ubuntu3","5.8.0-14.1ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.33-3.2ubuntu3","1.33.06-0ubuntu1","1.33.06-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm7"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2","2.1.0-7ubuntu0.16.04.5+esm5","2.1.0-7ubuntu0.16.04.5+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ayttm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.3-3build1","0.6.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cableswig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0+git20150808-1","0.1.0+git20150808-2","0.1.0+git20150808-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"insighttoolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20.1+git20120521-6","3.20.1+git20120521-6build1","3.20.1+git20120521-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1ubuntu3","4.8.1-1ubuntu4","4.8.2-3.1ubuntu1","4.9.0-3ubuntu2","4.9.0-4ubuntu1","4.9.0-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-4","2.4.7-4build1","2.4.7-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2","4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.1+dfsg-2","5.10.1+dfsg-2build3","5.10.1+dfsg-2.1build1","5.10.1+dfsg-2.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-0.2ubuntu3","1.33.14-1ubuntu1","1.33.14-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.8"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-2","3.1.4~abc9f50+dfsg2-1","3.1.4~abc9f50+dfsg3-1","3.1.4~abc9f50+dfsg3-2","3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5build1","0.13+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-5ubuntu1","2.4.7-5ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1","0.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-7","1.33.14-8","1.33.14-8build1","1.33.14-8ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.6"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4","2.2.9-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-6","0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build1","2.4.7-6build2","2.4.7-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-8build1","1.33.14-8build2","1.33.14-8ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.2"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1","0.11.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build3","2.4.7-6.1","2.4.7-6.1build1","2.4.7-6.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-9","1.33.14-10","1.33.14-10ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24+dfsg-2","0.24+dfsg-3","0.24+dfsg-3build1","0.24+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1","0.13+ds2-1build1","0.13+ds2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.3-1","0.9.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:115.3.1+build1-0ubuntu1","1:115.4.1+build1-0ubuntu1","1:115.4.3+build1-0ubuntu1","1:115.5.0+build1-0ubuntu1","1:115.5.1+build1-0ubuntu1","1:115.5.2+build2-0ubuntu1","1:115.6.0+build1-0ubuntu1","1:115.6.0+build2-0ubuntu1","1:115.6.1+build1-0ubuntu1","1:115.8.0+build1-0ubuntu1","1:115.8.1+build1+snap2","1:115.8.1+build1+snap3","2:1snap1-0ubuntu1","2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.8+dfsg-3","0.11.8+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.2","2.4.7-6.2build1","2.4.7-6.2build2","2.4.7-6.2build3","2.4.7-6.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-11","1.33.14-11.1","1.33.14-12","1.33.14-12build1","1.33.14-12build2","1.33.14-12ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.3","2.4.7-6.3build1","2.4.7-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-2","0.9.5.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-7","1.59.03-9","1.59.03-10","1.59.03-10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7.1","2.4.7-7.2","2.4.7-7.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-2","0.9.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-3","0.11.10+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.05-1","1.60.05-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2","0.28+dfsg-1","0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2","0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-3","0.9.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3","2:1snap1-0ubuntu4","2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2","0.11.10+dfsg-2build1","0.11.10+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-10.1","1.60.05-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7","2.4.7-7.1","2.4.7-7.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.8"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.5"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.1"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm7"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2","2.1.0-7ubuntu0.16.04.5+esm5","2.1.0-7ubuntu0.16.04.5+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7","2.2.5-3ubuntu0.8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.6"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4","2.2.9-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.2"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm7"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4","2.1.0-4ubuntu1.4+esm6"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libexpat_project","product":"libexpat"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410c_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"hci_compute_node_firmware"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://github.com/libexpat/libexpat/pull/650","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/libexpat/libexpat/issues/649","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report","web","article"]},{"url":"https://github.com/libexpat/libexpat/pull/616","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00033.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://www.debian.org/security/2022/dsa-5266","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202210-38","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BY4OPSIB33ETNUXZY2UPZ4NGQ3OKDY4D/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJ5VY2VYXE4WTRGQ6LMGLF6FV3SY37YE/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUJ2BULJTZ2BMSKQHB6US674P55UCWWS/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5XOOB7CD55CEE6OJYKSACSIMQ4RWQ6/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPQVIF6TOJNY2T3ZZETFKR4G34FFREBQ/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFCOMBSOJKLIKCGCJWHLJXO4EVYBG7AR/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20221118-0007/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/12/28/5","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/01/03/5","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-892048.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43680","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20221118-0007"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XG5XOOB7CD55CEE6OJYKSACSIMQ4RWQ6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUJ2BULJTZ2BMSKQHB6US674P55UCWWS"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FFCOMBSOJKLIKCGCJWHLJXO4EVYBG7AR"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPQVIF6TOJNY2T3ZZETFKR4G34FFREBQ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BY4OPSIB33ETNUXZY2UPZ4NGQ3OKDY4D"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AJ5VY2VYXE4WTRGQ6LMGLF6FV3SY37YE"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5XOOB7CD55CEE6OJYKSACSIMQ4RWQ6"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUJ2BULJTZ2BMSKQHB6US674P55UCWWS"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFCOMBSOJKLIKCGCJWHLJXO4EVYBG7AR"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPQVIF6TOJNY2T3ZZETFKR4G34FFREBQ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BY4OPSIB33ETNUXZY2UPZ4NGQ3OKDY4D"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJ5VY2VYXE4WTRGQ6LMGLF6FV3SY37YE"},{"url":"https://github.com/advisories/GHSA-4hjv-8mmr-jxwv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-43680","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0103","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43680","tags":["report"]},{"url":"https://bugzilla.redhat.com/2140059","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-0103.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0337","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-0337.html","tags":["advisory"]},{"url":"https://source.android.com/security/bulletin/2023-02-01","tags":["advisory"]},{"url":"https://android.googlesource.com/platform/external/expat/+/2e02df8552fcfb0facd2d1e324b227190a73a7bb","tags":["fix"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-43680","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1667412057.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2022-1667412749","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1667493762.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1667494718.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1667495485.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos7-els/CLSA-2023-1696877712.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43680.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-43680","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0409.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31057","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2022-0427.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31128","tags":["report"]},{"url":"https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/fHvKAhUTnLs","tags":["web"]},{"url":"https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_85.html","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0173.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31123","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2037","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8548","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143203","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143242","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143243","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8548.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140059","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43680","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45403","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45403","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45403","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45403","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45403","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45404","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45404","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45404","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45404","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45405","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45405","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45405","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45405","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45406","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45406","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45406","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45406","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45406","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45408","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45408","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45408","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45408","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45409","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45409","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45409","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45409","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45409","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45410","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45410","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45410","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45410","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45410","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45411","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45411","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45411","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45411","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45411","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45412","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45412","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45412","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45412","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45416","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45416","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45416","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45416","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45416","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45418","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45418","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45418","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45418","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45418","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45420","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45420","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45420","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45420","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45420","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45421","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45421","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45421","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-48/#CVE-2022-45421","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2022-49/#CVE-2022-45421","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8549","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8549.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8550","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8550.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8553","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8553.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8554","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8554.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0103.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0337.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0421","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0421.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22785","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1000109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044457","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044488","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056354","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2310137","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2395108","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22785.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0340","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0340","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45960","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45960","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45960","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/531","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-46143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46143","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/532","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22822","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22822","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/pull/539","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22823","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22823","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22824","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22824","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22825","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22825","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22826","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22826","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22827","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22827","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22827","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23990","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23990","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25313","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25313","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25313","tags":["advisory"]},{"url":"https://blog.hartwork.org/posts/expat-2-4-5-released/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25314","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25314","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25314","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-52425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52425","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52425","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-8176","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-8176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8176","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/893","tags":["article"]},{"url":"https://github.com/libexpat/libexpat/pull/973","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59375","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59375","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2025-59375","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2025-59375","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22871","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1752592","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22871.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20843","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20843","tags":["advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15903","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15903","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0103","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:0337","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223874-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1204708","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43680","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223884-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223912-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624323-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249584","tags":["report"]},{"url":"https://bugzilla.suse.com/1257144","tags":["report"]},{"url":"https://bugzilla.suse.com/1257496","tags":["report"]},{"url":"https://bugzilla.suse.com/1259711","tags":["report"]},{"url":"https://bugzilla.suse.com/1259726","tags":["report"]},{"url":"https://bugzilla.suse.com/1259729","tags":["report"]},{"url":"https://bugzilla.suse.com/1262263","tags":["report"]},{"url":"https://bugzilla.suse.com/1264713","tags":["report"]},{"url":"https://bugzilla.suse.com/1267631","tags":["report"]},{"url":"https://bugzilla.suse.com/1268572","tags":["report"]},{"url":"https://bugzilla.suse.com/1268573","tags":["report"]},{"url":"https://bugzilla.suse.com/1275115","tags":["report"]},{"url":"https://bugzilla.suse.com/1275594","tags":["report"]},{"url":"https://bugzilla.suse.com/1275732","tags":["report"]},{"url":"https://bugzilla.suse.com/1275859","tags":["report"]},{"url":"https://bugzilla.suse.com/1275860","tags":["report"]},{"url":"https://bugzilla.suse.com/1275915","tags":["report"]},{"url":"https://bugzilla.suse.com/1282347","tags":["report"]},{"url":"https://bugzilla.suse.com/1283493","tags":["report"]},{"url":"https://bugzilla.suse.com/1284334","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93990","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264615-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264623-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-43680","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5638-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5638-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5638-4","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-40674","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-43680","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.","status":"published","published":"2022-10-24T00:00:00Z","modified":"2026-10-14T18:26:49.62Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:34:25.618175Z"}],"euvd":[{"id":"EUVD-2022-46673","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.","status":"published","published":"2022-10-24T00:00:00Z","modified":"2026-10-14T18:26:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:13.272666Z"}],"ghsa":[{"id":"GHSA-4hjv-8mmr-jxwv","title":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared...","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.","status":"published","published":"2022-10-24T19:00:20Z","modified":"2026-10-14T21:31:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:13:28.606179Z"}],"nvd":[{"id":"CVE-2022-43680","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.","status":"published","published":"2022-10-24T14:15:53.323Z","modified":"2026-10-14T19:16:53.627Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"ALPINE-CVE-2022-43680","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.","status":"published","published":"2022-10-24T14:15:53.323Z","modified":"2026-11-03T07:18:33.765676215Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-11316","title":"CVE-2022-43680 affecting package expat for versions less than 2.5.0-1","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.","status":"published","published":"2022-10-24T14:15:53Z","modified":"2026-04-21T04:21:58.885773Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"BELL-CVE-2022-43680","title":"CVE-2022-43680 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:59.676348Z","modified":"2026-01-26T09:50:06.058254Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-43680","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.","status":"published","published":"2022-10-24T00:00:00Z","modified":"2026-10-28T02:30:30.496223849Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:27.186787Z"},{"id":"DEBIAN-CVE-2022-43680","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.","status":"published","published":"2022-10-24T14:15:53.323Z","modified":"2026-11-03T08:04:11.304789059Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:07.763774Z"},{"id":"JLSEC-2025-58","title":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD...","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in `XML_ExternalEntityParserCreate` in out-of-memory situations.","status":"published","published":"2025-10-14T15:35:41.198Z","modified":"2026-07-25T18:23:43.303379047Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2022-2037","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\n\r\n\r\nSecurity Fix(es):\r\n\r\nIn libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.(CVE-2022-43680)","status":"published","published":"2022-11-04T11:05:21Z","modified":"2026-08-18T01:17:21.630825467Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"RHSA-2022:8548","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-16T09:47:30Z","modified":"2026-10-15T10:03:23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8549","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-16T09:47:36Z","modified":"2026-10-15T10:03:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8550","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-16T09:47:44Z","modified":"2026-10-15T10:03:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8553","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-16T09:48:07Z","modified":"2026-10-15T10:03:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:8554","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-16T09:47:59Z","modified":"2026-10-15T10:03:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:0103","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-16T09:45:36Z","modified":"2026-10-15T10:03:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2023:0337","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-16T09:45:45Z","modified":"2026-10-15T10:03:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2024:0421","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-16T09:46:05Z","modified":"2026-10-15T10:06:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2025:22785","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-12-05T10:08:28Z","modified":"2026-10-15T10:10:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:22871","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-12-09T10:06:09Z","modified":"2026-10-15T10:10:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RLSA-2023:0103","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* expat: use-after free caused by overeager destruction of a shared DTD in\nXML_ExternalEntityParserCreate (CVE-2022-43680)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s)\nlisted in the References section.","status":"published","published":"2023-01-12T08:25:33Z","modified":"2026-02-04T13:00:08.601503Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"RLSA-2023:0337","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate (CVE-2022-43680)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-23T14:30:30Z","modified":"2026-02-04T22:00:10.413889Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2022-43680","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.","status":"published","published":"2022-10-24T14:15:00Z","modified":"2026-10-17T12:53:52.672875385Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"ALSA-2023:0103","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* expat: use-after free caused by overeager destruction of a shared DTD in\nXML_ExternalEntityParserCreate (CVE-2022-43680)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s)\nlisted in the References section.","status":"published","published":"2023-01-12T00:00:00Z","modified":"2026-10-29T11:01:58.018300597Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:0337","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate (CVE-2022-43680)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-01-23T00:00:00Z","modified":"2026-10-29T11:31:22.916274371Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ASB-A-255449293","description":"In parserCreate of xmlparse.c, there is a possible use after free that could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2023-02-01T00:00:00Z","modified":"2026-11-10T17:02:23.040266809Z","updated_at":"2026-11-10T17:35:05.865114Z"},{"id":"CLSA-2022-1667412057","title":"expat: Fix of CVE-2022-43680","description":"- CVE-2022-43680: Fix overeager DTD destruction","status":"published","published":"2022-11-02T18:00:57Z","modified":"2026-06-01T00:32:44.858858149Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1667412749","title":"Fix CVE(s): CVE-2022-43680","description":"\n   * SECURITY UPDATE: Fix overeager DTD destruction\n     - debian/patches/CVE-2022-43680: Fix heap use-after-free after overeager\n       destruction of a shared DTD in function XML_ExternalEntityParserCreate\n       in out-of-memory situations\n     - CVE-2022-43680","status":"published","published":"2022-11-02T18:12:29Z","modified":"2026-06-04T10:03:12.291337Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1667493762","title":"expat: Fix of CVE-2022-43680","description":"- CVE-2022-43680: Fix overeager DTD destruction","status":"published","published":"2022-11-03T16:42:42Z","modified":"2026-06-01T00:33:15.837498226Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1667494718","title":"expat: Fix of CVE-2022-43680","description":"- CVE-2022-43680: Fix overeager DTD destruction","status":"published","published":"2022-11-03T16:58:38Z","modified":"2026-06-01T00:32:01.200070203Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1667495485","title":"expat: Fix of CVE-2022-43680","description":"- CVE-2022-43680: Fix overeager DTD destruction","status":"published","published":"2022-11-03T17:11:25Z","modified":"2026-06-01T00:32:39.036569072Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2023-1696877712","title":"expat: Fix of 2 CVEs","description":"- CVE-2022-23990: lib: prevent integer overflow in function doProlog\n- CVE-2022-43680: fix overeager DTD destruction in\n  XML_ExternalEntityParserCreate","status":"published","published":"2023-10-09T18:55:16Z","modified":"2026-06-01T00:33:17.309381016Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"DLA-3165-1","title":"expat - security update","status":"published","published":"2022-10-28T00:00:00Z","modified":"2026-03-09T01:20:58.542496Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5266-1","title":"expat - security update","status":"published","published":"2022-10-30T00:00:00Z","modified":"2026-03-09T02:09:38.437126Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0409","title":"Updated expat packages fix security vulnerability","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager\ndestruction of a shared DTD in XML_ExternalEntityParserCreate in\nout-of-memory situations. (CVE-2022-43680)\n","status":"published","published":"2022-11-04T21:16:03Z","modified":"2026-04-16T04:40:43.983086558Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"MGASA-2022-0427","title":"Updated firefox packages fix security vulnerability","description":"In libexpat through 2.4.9, there is a use-after free caused by overeager\ndestruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory\nsituations (CVE-2022-43680).\n\nService Workers should not be able to infer information about opaque\ncross-origin responses; but timing information for cross-origin media combined\nwith Range requests might have allowed them to determine the presence or\nlength of a media file (CVE-2022-45403).\n\nThrough a series of popup and window.print() calls, an attacker can cause a\nwindow to go fullscreen without the user seeing the notification prompt,\nresulting in potential user confusion or spoofing attacks (CVE-2022-45404).\n\nFreeing arbitrary nsIInputStream's on a different thread than creation could\nhave led to a use-after-free and potentially exploitable crash\n(CVE-2022-45405).\n\nIf an out-of-memory condition occurred when creating a JavaScript global, a\nJavaScript realm may be deleted while references to it lived on in a\nBaseShape. This could lead to a use-after-free causing a potentially\nexploitable crash (CVE-2022-45406).\n\nThrough a series of popups that reuse windowName, an attacker can cause a\nwindow to go fullscreen without the user seeing the notification prompt,\nresulting in potential user confusion or spoofing attacks (CVE-2022-45408).\n\nThe garbage collector could have been aborted in several states and zones and\nGCRuntime::finishCollection may not have been called, leading to a\nuse-after-free and potentially exploitable crash (CVE-2022-45409).\n\nWhen a ServiceWorker intercepted a request with FetchEvent, the origin of the\nrequest was lost after the ServiceWorker took ownership of it. This had the\neffect of negating SameSite cookie protections. This was addressed in the spec\nand then in browsers (CVE-2022-45410).\n\nCross-Site Tracing occurs when a server will echo a request back via the Trace\nmethod, allowing an XSS attack to access to authorization headers and cookies\ninaccessible to JavaScript (such as cookies protected by HTTPOnly). To\nmitigate this attack, browsers placed limits on fetch() and XMLHttpRequest;\nhowever some webservers have implemented non-standard headers such as\nX-Http-Method-Override that override the HTTP method, and made this attack\npossible again. Firefox has applied the same mitigations to the use of this\nand similar headers (CVE-2022-45411).\n\nWhen resolving a symlink such as file:///proc/self/fd/1, an error message may\nbe produced where the symlink was resolved to a string containing unitialized\nmemory in the buffer (CVE-2022-45412).\n\nKeyboard events reference strings like \"KeyA\" that were at fixed, known, and\nwidely-spread addresses. Cache-based timing attacks such as Prime+Probe could\nhave possibly figured out which keys were being pressed (CVE-2022-45416).\n\nIf a custom mouse cursor is specified in CSS, under certain circumstances the\ncursor could have been drawn over the browser UI, resulting in potential user\nconfusion or spoofing attacks (CVE-2022-45418).\n\nUse tables inside of an iframe, an attacker could have caused iframe contents\nto be rendered outside the boundaries of the iframe, resulting in potential\nuser confusion or spoofing attacks (CVE-2022-45420).\n\nMozilla developers Andrew McCreight and Gabriele Svelto reported memory safety\nbugs present in Firefox ESR 102.4. Some of these bugs showed evidence of\nmemory corruption and we presume that with enough effort some of these could\nhave been exploited to run arbitrary code (CVE-2022-45421).\n","status":"published","published":"2022-11-17T20:45:15Z","modified":"2026-04-16T04:44:06.508948257Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"MGASA-2026-0173","title":"Updated xmlrpc-c packages fix security vulnerabilities","description":"This update fixes the vulnerabilities by no longer building with the\nvulnerable bundled libexpat version.\n","status":"published","published":"2026-06-05T17:37:45Z","modified":"2026-06-05T17:45:08.885986445Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:12449-1","title":"expat-2.5.0-1.1 on GA media","description":"These are all security issues fixed in the expat-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:13:44.865209Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2022:3874-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n  - CVE-2022-43680: Fixed use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate (bsc#1204708).\n","status":"published","published":"2022-11-04T14:07:11Z","modified":"2026-02-04T02:46:27.038271Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3884-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n  - CVE-2022-43680: Fixed use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate (bsc#1204708).\n","status":"published","published":"2022-11-07T09:59:33Z","modified":"2025-05-02T04:33:47.599737Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3912-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n  - CVE-2022-43680: Fixed use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate (bsc#1204708).\n","status":"published","published":"2022-11-08T12:38:20Z","modified":"2026-02-04T03:19:08.096135Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2026:24323-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove \"harmless\" cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-17T13:49:25Z","modified":"2026-10-27T17:23:13.622800769Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4615-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-12T07:20:23Z","modified":"2026-10-13T10:30:04.873577795Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4623-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n  \n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-12T07:27:49Z","modified":"2026-10-13T10:30:05.847197418Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-5638-2","title":"expat vulnerabilities","description":"USN-5638-1 fixed a vulnerability in Expat. This update provides\nthe corresponding updates for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and\nUbuntu 22.04 LTS.\n\nIt was discovered that Expat incorrectly handled memory in out-of-memory\nsituations. An attacker could possibly use this issue to cause a crash,\n resulting in a denial of service, or possibly execute arbitrary code.\n This issue only affected Ubuntu 18.04 LTS. (CVE-2022-43680)\n\nOriginal advisory details:\n\n Rhodri James discovered that Expat incorrectly handled memory when\n processing certain malformed XML files. An attacker could possibly\n use this issue to cause a crash or execute arbitrary code.\n","status":"published","published":"2022-11-17T09:56:58Z","modified":"2026-04-27T16:21:14.658199Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5638-3","title":"expat vulnerability","description":"USN-5638-1 fixed a vulnerability in Expat. This update provides\nthe corresponding updates for Ubuntu 16.04 ESM, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-43680)\nThis update also fixes a minor regression introduced in\nUbuntu 18.04 LTS.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Rhodri James discovered that Expat incorrectly handled memory when\n processing certain malformed XML files. An attacker could possibly\n use this issue to cause a crash or execute arbitrary code.\n","status":"published","published":"2022-11-23T15:09:26Z","modified":"2026-06-25T13:31:24.468088195Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5638-4","title":"expat vulnerabilities","description":"USN-5638-1 fixed several vulnerabilities in Expat. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n Rhodri James discovered that Expat incorrectly handled memory when\n processing certain malformed XML files. An attacker could possibly\n use this issue to cause a crash or execute arbitrary code.\n","status":"published","published":"2023-02-28T15:19:01Z","modified":"2026-06-29T13:49:42.120781819Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}