{"id":"CVE-2024-28757","aliases":["ALPINE-CVE-2024-28757","ALSA-2024:1530","ALSA-2025:21776","AZL-35841","AZL-35880","BELL-CVE-2024-28757","CLSA-2025-1741291038","CLSA-2026-1767798754","CLSA-2026-1767799061","CLSA-2026-1767799681","CLSA-2026-1776440644","CLSA-2026-1776441540","CLSA-2026-1776441769","DEBIAN-CVE-2024-28757","EUVD-2024-25843","GHSA-ch5v-h69f-mxc8","JLSEC-2025-61","MGASA-2024-0072","OESA-2024-1379","RHBA-2024:2518","RHSA-2024:1530","RHSA-2024:3926","RHSA-2025:21776","ROOT-OS-DEBIAN-11-CVE-2024-28757","ROOT-OS-DEBIAN-12-CVE-2024-28757","SUSE-SU-2024:1129-1","SUSE-SU-2024:1129-2","SUSE-SU-2025:20045-1","SUSE-SU-2025:20207-1","SUSE-SU-2025:20311-1","UBUNTU-CVE-2024-28757","USN-6694-1","openSUSE-SU-2024:13779-1"],"status":"published","title":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of...","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02006,"percentile":0.80964,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-776"],"published":"2024-03-10T00:00:00Z","modified":"2026-11-10T12:33:11Z","exploits":[{"source":"pocgithub","id":"RenukaSelvar/expat_CVE-2024-28757","title":"RenukaSelvar/expat_CVE-2024-28757","date":"2024-05-03","url":"https://github.com/RenukaSelvar/expat_CVE-2024-28757"},{"source":"pocgithub","id":"saurabh2088/expat_2_1_0_CVE-2024-28757","title":"saurabh2088/expat_2_1_0_CVE-2024-28757","date":"2024-05-03","url":"https://github.com/saurabh2088/expat_2_1_0_CVE-2024-28757"}],"fixes":[{"ecosystem":"Alpine:v3.16","package":"expat","fixed_in":["2.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"expat","fixed_in":["2.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"expat","fixed_in":["2.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"expat","fixed_in":["2.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"expat","fixed_in":["2.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"expat","fixed_in":["2.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"expat","fixed_in":["2.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"expat","fixed_in":["2.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"expat","fixed_in":["2.6.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"expat","fixed_in":["2.6.2-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"expat","fixed_in":["2.6.2-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"expat","fixed_in":["2.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"expat","fixed_in":["2.6.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"expat","fixed_in":["2.6.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"expat","fixed_in":["2.6.2-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat","fixed_in":["2.5.0-1.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-devel","fixed_in":["2.5.0-1.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-static","fixed_in":["2.5.0-1.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"expat","fixed_in":["2.5.0-1+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.6.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.6.1-2"],"sources":["osv"]},{"ecosystem":"Julia","package":"Expat_jll","fixed_in":["2.6.2+0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debuginfo","fixed_in":["0:2.5.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debugsource","fixed_in":["0:2.5.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-devel","fixed_in":["0:2.5.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat","fixed_in":["0:2.5.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debuginfo","fixed_in":["0:2.5.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debugsource","fixed_in":["0:2.5.0-2.el9_4"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"expat","fixed_in":["2.2.10-2+deb11u7.root.io.14","2.2.10-2+deb11u7.aikido.17","2.2.10-2+deb11u7.root.io.8","2.2.10-2+deb11u7.root.io.15","2.2.10-2+deb11u7.aikido.19","2.2.10-2+deb11u7.root.io.11","2.2.10-2+deb11u7.root.io.10","2.2.10-2+deb11u7.aikido.18","2.2.10-2+deb11u7.root.io.12","2.2.10-2+deb11u7.aikido.20","2.2.10-2+deb11u7.root.io.9","2.2.10-2+deb11u7.root.io.16","2.2.10-2+deb11u7.root.io.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-expat","fixed_in":["2.2.10-2+deb11u7.root.io.14","2.2.10-2+deb11u7.aikido.17","2.2.10-2+deb11u7.root.io.8","2.2.10-2+deb11u7.root.io.15","2.2.10-2+deb11u7.aikido.19","2.2.10-2+deb11u7.root.io.11","2.2.10-2+deb11u7.root.io.10","2.2.10-2+deb11u7.aikido.18","2.2.10-2+deb11u7.root.io.12","2.2.10-2+deb11u7.aikido.20","2.2.10-2+deb11u7.root.io.9","2.2.10-2+deb11u7.root.io.16","2.2.10-2+deb11u7.root.io.13"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"expat","fixed_in":["2.4.7-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"expat","fixed_in":["2.6.2-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9_3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9_3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-r0"},{"fixed":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9-r0"},{"fixed":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-r0"},{"fixed":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9-r0"},{"fixed":"2.6.2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1+deb12u4"}]}],"versions":["2.5.0-1","2.5.0-1+deb12u1","2.5.0-1+deb12u2","2.5.0-1+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4.1","1.2-4.1~exp1","1.2-4.2"]},{"source":"osv","ecosystem":"Julia","package":"Expat_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.2+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-11.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-11.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-10.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-10.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-10.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-10.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:Debian:11","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u7.root.io.14"},{"fixed":"2.2.10-2+deb11u7.aikido.17"},{"fixed":"2.2.10-2+deb11u7.root.io.8"},{"fixed":"2.2.10-2+deb11u7.root.io.15"},{"fixed":"2.2.10-2+deb11u7.aikido.19"},{"fixed":"2.2.10-2+deb11u7.root.io.11"},{"fixed":"2.2.10-2+deb11u7.root.io.10"},{"fixed":"2.2.10-2+deb11u7.aikido.18"},{"fixed":"2.2.10-2+deb11u7.root.io.12"},{"fixed":"2.2.10-2+deb11u7.aikido.20"},{"fixed":"2.2.10-2+deb11u7.root.io.9"},{"fixed":"2.2.10-2+deb11u7.root.io.16"},{"fixed":"2.2.10-2+deb11u7.root.io.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u7.root.io.14"},{"fixed":"2.2.10-2+deb11u7.aikido.17"},{"fixed":"2.2.10-2+deb11u7.root.io.8"},{"fixed":"2.2.10-2+deb11u7.root.io.15"},{"fixed":"2.2.10-2+deb11u7.aikido.19"},{"fixed":"2.2.10-2+deb11u7.root.io.11"},{"fixed":"2.2.10-2+deb11u7.root.io.10"},{"fixed":"2.2.10-2+deb11u7.aikido.18"},{"fixed":"2.2.10-2+deb11u7.root.io.12"},{"fixed":"2.2.10-2+deb11u7.aikido.20"},{"fixed":"2.2.10-2+deb11u7.root.io.9"},{"fixed":"2.2.10-2+deb11u7.root.io.16"},{"fixed":"2.2.10-2+deb11u7.root.io.13"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-slfo.1.1_1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50-3","3.1.4~abc9f50-4","3.1.4~abc9f50-4ubuntu2","3.1.4~abc9f50-4ubuntu2+esm1","3.1.4~abc9f50-4ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4","2.1.0-4ubuntu1.4+esm6","2.1.0-4ubuntu1.4+esm7","2.1.0-4ubuntu1.4+esm8","2.1.0-4ubuntu1.4+esm9","2.1.0-4ubuntu1.4+esm10","2.1.0-4ubuntu1.4+esm11","2.1.0-4ubuntu1.4+esm12","2.1.0-4ubuntu1.4+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37ubuntu5","4.1.1+xorg4.3.0-37ubuntu5.0.1","4.1.1+xorg4.3.0-37ubuntu5.0.2","4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14ubuntu1","5.8.0-14ubuntu3","5.8.0-14.1ubuntu2","5.8.0-14.1ubuntu3","5.8.0-14.1ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.33-3.2ubuntu3","1.33.06-0ubuntu1","1.33.06-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2","2.1.0-7ubuntu0.16.04.5+esm5","2.1.0-7ubuntu0.16.04.5+esm6","2.1.0-7ubuntu0.16.04.5+esm7","2.1.0-7ubuntu0.16.04.5+esm8","2.1.0-7ubuntu0.16.04.5+esm9","2.1.0-7ubuntu0.16.04.5+esm10","2.1.0-7ubuntu0.16.04.5+esm11","2.1.0-7ubuntu0.16.04.5+esm12","2.1.0-7ubuntu0.16.04.5+esm13","2.1.0-7ubuntu0.16.04.5+esm14"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ayttm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.3-3build1","0.6.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cableswig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0+git20150808-1","0.1.0+git20150808-2","0.1.0+git20150808-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.4-4","2.4.4-4build1","2.4.4-4ubuntu1","2.6.1-3","2.6.2-1","2.6.2-2","2.6.2-3","2.6.3-1","2.6.3-1ubuntu1","2.6.3-2ubuntu1","2.6.3-3ubuntu1","2.6.3-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1ubuntu3","4.8.1-1ubuntu4","4.8.2-3.1ubuntu1","4.9.0-3ubuntu2","4.9.0-4ubuntu1","4.9.0-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-3build3","1.2-3ubuntu0.1~esm1","1.2-3ubuntu0.16.04.1~esm1","1.2-3ubuntu0.16.04.1~esm2","1.2-3ubuntu0.16.04.1~esm3","1.2-3ubuntu0.16.04.1~esm4","1.2-3ubuntu0.16.04.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-4","2.4.7-4build1","2.4.7-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2","4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.1+dfsg-2","5.10.1+dfsg-2build3","5.10.1+dfsg-2.1build1","5.10.1+dfsg-2.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-0.2ubuntu3","1.33.14-1ubuntu1","1.33.14-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7","2.2.5-3ubuntu0.8","2.2.5-3ubuntu0.9","2.2.5-3ubuntu0.9+esm1","2.2.5-3ubuntu0.9+esm2","2.2.5-3ubuntu0.9+esm3","2.2.5-3ubuntu0.9+esm4","2.2.5-3ubuntu0.9+esm5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-2","3.1.4~abc9f50+dfsg2-1","3.1.4~abc9f50+dfsg3-1","3.1.4~abc9f50+dfsg3-2","3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-3build1","2.8.3-1","2.8.4-1","2.8.4-1build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4ubuntu0.18.04.1~esm1","1.2-4ubuntu0.18.04.1~esm2","1.2-4ubuntu0.18.04.1~esm3","1.2-4ubuntu0.18.04.1~esm4","1.2-4ubuntu0.18.04.1~esm5","1.2-4ubuntu0.18.04.1~esm6","1.2-4ubuntu0.18.04.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5build1","0.13+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-5ubuntu1","2.4.7-5ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1","0.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-7","1.33.14-8","1.33.14-8build1","1.33.14-8ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4","2.2.9-1ubuntu0.5","2.2.9-1ubuntu0.6","2.2.9-1ubuntu0.7","2.2.9-1ubuntu0.8","2.2.9-1ubuntu0.8+esm1","2.2.9-1ubuntu0.8+esm2","2.2.9-1ubuntu0.8+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-4.1ubuntu1","4.13.2-dfsg1-1ubuntu1","4.13.2-dfsg1-4ubuntu1","4.13.2-dfsg1-6","4.13.2-dfsg1-6ubuntu1","4.13.2-dfsg1-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4ubuntu0.20.04.1~esm1","1.2-4ubuntu0.20.04.1~esm2","1.2-4ubuntu0.20.04.1~esm3","1.2-4ubuntu0.20.04.1~esm4","1.2-4ubuntu0.20.04.1~esm5","1.2-4ubuntu0.20.04.1~esm6","1.2-4ubuntu0.20.04.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-6","0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build1","2.4.7-6build2","2.4.7-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-8build1","1.33.14-8build2","1.33.14-8ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.3"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1","2.4.7-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.3withdata-dfsg1-4.1","4.13.3withdata-dfsg2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1","0.11.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build3","2.4.7-6.1","2.4.7-6.1build1","2.4.7-6.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-9","1.33.14-10","1.33.14-10ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24+dfsg-2","0.24+dfsg-3","0.24+dfsg-3build1","0.24+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4ubuntu1","1.2-4.1ubuntu1","1.2-4.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1","0.13+ds2-1build1","0.13+ds2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.3-1","0.9.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.8+dfsg-3","0.11.8+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.2","2.4.7-6.2build1","2.4.7-6.2build2","2.4.7-6.2build3","2.4.7-6.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-11","1.33.14-11.1","1.33.14-12","1.33.14-12build1","1.33.14-12build2","1.33.14-12ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.3","2.4.7-6.3build1","2.4.7-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-2","0.9.5.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-7","1.59.03-9","1.59.03-10","1.59.03-10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7.1","2.4.7-7.2","2.4.7-7.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-2","0.9.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-3","0.11.10+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.05-1","1.60.05-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2","0.28+dfsg-1","0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2","0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-3","0.9.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2","0.11.10+dfsg-2build1","0.11.10+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-10.1","1.60.05-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7","2.4.7-7.1","2.4.7-7.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.3"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1","2.4.7-1ubuntu0.2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-1.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"libexpat_project","product":"libexpat"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410c_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h610c_firmware"},{"vendor":"netapp","product":"h610s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"netapp","product":"ontap"},{"vendor":"netapp","product":"ontap_tools"},{"vendor":"netapp","product":"windows_host_utilities"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ac0)"},{"vendor":"siemens","product":"sinec nms"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp (6ag1518-4ax00-4ac0)"}],"references":[{"url":"https://github.com/libexpat/libexpat/pull/842","tags":["x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/libexpat/libexpat/issues/839","tags":["x_transferred","Exploit","Issue Tracking","Patch","report","web","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/","tags":["vendor-advisory","x_transferred","Mailing List","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/","tags":["vendor-advisory","x_transferred","Mailing List","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240322-0001/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/","tags":["vendor-advisory","x_transferred","Mailing List","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/03/15/1","tags":["mailing-list","x_transferred","Mailing List","Patch","Release Notes","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784301.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28757","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7"},{"url":"https://security.netapp.com/advisory/ntap-20240322-0001"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VK2O34GH43NTHBZBN7G5Y6YKJKPUCTBE"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7"},{"url":"https://github.com/advisories/GHSA-ch5v-h69f-mxc8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-28757","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1530","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-52425","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28757","tags":["report"]},{"url":"https://bugzilla.redhat.com/2262877","tags":["report"]},{"url":"https://bugzilla.redhat.com/2268766","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-1530.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:21776","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59375","tags":["report"]},{"url":"https://bugzilla.redhat.com/2395108","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-21776.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2013-0340.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2022-23990.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2024-28757.html","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-28757","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-22","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1741291038.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1767798754.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1767799061.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1767799681.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1776440644.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1776441540.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1776441769.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28757.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-28757","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0072.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32970","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6694-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52426","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2024:2518","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_2518.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268766","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28757","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262877","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1530.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52425","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52425","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3926","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3926.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2395108","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21776.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1000109","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0340","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0340","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048356","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23990","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59375","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2025-59375","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2025-59375","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241129-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219559","tags":["report"]},{"url":"https://bugzilla.suse.com/1221289","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28757","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241129-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520045-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1229930","tags":["report"]},{"url":"https://bugzilla.suse.com/1229931","tags":["report"]},{"url":"https://bugzilla.suse.com/1229932","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45492","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520207-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219561","tags":["report"]},{"url":"https://bugzilla.suse.com/1232579","tags":["report"]},{"url":"https://bugzilla.suse.com/1232601","tags":["report"]},{"url":"https://bugzilla.suse.com/1239618","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8176","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520311-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-28757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-52425","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-28757","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).","status":"published","published":"2024-03-10T00:00:00Z","modified":"2026-11-10T12:33:11.077Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-776"],"updated_at":"2026-11-10T13:38:44.039016Z"}],"euvd":[{"id":"EUVD-2024-25843","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).","status":"published","published":"2024-03-10T00:00:00Z","modified":"2026-11-10T12:33:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T13:21:01.211897Z"}],"ghsa":[{"id":"GHSA-ch5v-h69f-mxc8","title":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of...","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).","status":"published","published":"2024-03-10T06:30:38Z","modified":"2026-11-10T15:31:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-776"],"updated_at":"2026-11-10T15:55:01.006697Z"}],"nvd":[{"id":"CVE-2024-28757","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).","status":"published","published":"2024-03-10T05:15:06.57Z","modified":"2026-11-10T13:17:21.73Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-776"],"updated_at":"2026-11-10T16:19:43.518378Z"}],"osv":[{"id":"ALPINE-CVE-2024-28757","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).","status":"published","published":"2024-03-10T05:15:06.57Z","modified":"2026-11-02T11:17:50.084420312Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-35841","title":"CVE-2024-28757 affecting package expat for versions less than 2.6.2-2","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).","status":"published","published":"2024-03-10T05:15:06Z","modified":"2026-04-21T04:25:09.380635Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-35880","title":"CVE-2024-28757 affecting package expat for versions less than 2.6.2-1","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).","status":"published","published":"2024-03-10T05:15:06Z","modified":"2026-04-21T04:32:31.733858Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"BELL-CVE-2024-28757","status":"published","published":"2024-03-11T05:56:35.969205Z","modified":"2026-01-26T09:36:31.207474Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:19.66992Z"},{"id":"CVE-2024-28757","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).","status":"published","published":"2024-03-10T00:00:00Z","modified":"2026-10-29T11:12:03.678555943Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"DEBIAN-CVE-2024-28757","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).","status":"published","published":"2024-03-10T05:15:06.57Z","modified":"2026-11-02T12:01:31.34592213Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"JLSEC-2025-61","title":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external...","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via `XML_ExternalEntityParserCreate`).","status":"published","published":"2025-10-14T15:35:41.198Z","modified":"2026-07-25T18:23:44.483680914Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2024-1379","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\r\n\r\nlibexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.(CVE-2023-52426)\r\n\r\nlibexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).(CVE-2024-28757)","status":"published","published":"2024-04-12T11:06:49Z","modified":"2026-08-18T01:18:20.443626586Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHBA-2024:2518","title":"Red Hat Bug Fix Advisory: expat bug fix and enhancement update","status":"published","published":"2025-06-06T10:01:41Z","modified":"2026-10-15T10:06:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2024:1530","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-16T18:30:22Z","modified":"2026-10-15T10:07:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:3926","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-16T18:30:58Z","modified":"2026-10-15T10:08:14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2025:21776","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-11-20T11:01:06Z","modified":"2026-10-15T10:10:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2024-28757","title":"CVE-2024-28757 in expat - Patched by Root","description":"Root has patched CVE-2024-28757 in the expat package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-10-19T10:19:12Z","modified":"2026-10-19T11:15:03.231829113Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.80888Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-28757","title":"CVE-2024-28757 in expat - Patched by Root","description":"Root has patched CVE-2024-28757 in the expat package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-25T11:40:57Z","modified":"2026-10-06T19:00:05.807805027Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"UBUNTU-CVE-2024-28757","description":"libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).","status":"published","published":"2024-03-10T00:00:00Z","modified":"2026-10-17T12:56:44.189618826Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"ALSA-2024:1530","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)\n* expat: XML Entity Expansion (CVE-2024-28757)","status":"published","published":"2024-03-26T00:00:00Z","modified":"2026-10-29T11:31:05.472590441Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2025:21776","title":"Important: expat security update","description":"Expat is a C library for parsing XML documents. \n\nSecurity Fix(es): \n\n * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-11-19T00:00:00Z","modified":"2026-10-29T11:12:04.817616633Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"CLSA-2025-1741291038","title":"expat: Fix of CVE-2024-28757","description":"- CVE-2024-28757: Prevent billion laughs attacks in isolated external parser (part of #839)\n Reject direct parameter entity recursion (part of #839)","status":"published","published":"2025-03-06T19:57:23Z","modified":"2026-06-01T00:30:31.085473626Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2026-1767798754","title":"expat: Fix of 3 CVEs","description":"- Rebase to version 2.5.0\n- CVE-2024-28757: prevent billion laughs attacks in isolated external parser\n (part of #839), reject direct parameter entity recursion (part of #839)\n- CVE-2025-59375: fix memory amplification and add allocation tracker\n- CVE-2013-0340: properly handle entities expansion","status":"published","published":"2026-01-07T15:12:38Z","modified":"2026-10-21T10:47:10.47674306Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1767799061","title":"expat: Fix of 3 CVEs","description":"- Rebase to version 2.5.0\n- CVE-2024-28757: prevent billion laughs attacks in isolated external parser\n (part of #839), reject direct parameter entity recursion (part of #839)\n- CVE-2025-59375: fix memory amplification and add allocation tracker\n- CVE-2013-0340: properly handle entities expansion","status":"published","published":"2026-01-07T15:17:44Z","modified":"2026-10-21T10:48:06.109784822Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1767799681","title":"expat: Fix of 3 CVEs","description":"- Rebase to version 2.5.0\n- CVE-2024-28757: prevent billion laughs attacks in isolated external parser\n (part of #839), reject direct parameter entity recursion (part of #839)\n- CVE-2025-59375: fix memory amplification and add allocation tracker\n- CVE-2013-0340: properly handle entities expansion","status":"published","published":"2026-01-07T15:28:05Z","modified":"2026-10-21T10:48:24.020279236Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1776440644","title":"expat: Fix of 4 CVEs","description":"- CVE-2017-9233: fix external entity infinite loop in entityValueInitProcessor\n and entityValueProcessor\n- CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of\n large tokens in small buffer refills; fix buffer growth calculation\n- CVE-2013-0340: add billion laughs (entity expansion bomb)\n attack protection with amplification limit (100x max, 8 MiB activation\n threshold); includes fix for isolated external parser bypass (CVE-2024-28757)\n- CVE-2024-28757: add billion laughs (entity expansion bomb)\n attack protection with amplification limit (100x max, 8 MiB activation\n threshold); includes fix for isolated external parser bypass (CVE-2024-28757)","status":"published","published":"2026-04-21T17:07:46Z","modified":"2026-10-21T10:45:19.53238604Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776441540","title":"expat: Fix of 4 CVEs","description":"- CVE-2017-9233: fix external entity infinite loop in entityValueInitProcessor\n and entityValueProcessor\n- CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of\n large tokens in small buffer refills; fix buffer growth calculation\n- CVE-2013-0340: add billion laughs (entity expansion bomb)\n attack protection with amplification limit (100x max, 8 MiB activation\n threshold); includes fix for isolated external parser bypass (CVE-2024-28757)\n- CVE-2024-28757: add billion laughs (entity expansion bomb)\n attack protection with amplification limit (100x max, 8 MiB activation\n threshold); includes fix for isolated external parser bypass (CVE-2024-28757)","status":"published","published":"2026-04-20T08:47:49Z","modified":"2026-10-21T10:48:02.488236575Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776441769","title":"expat: Fix of 4 CVEs","description":"- CVE-2017-9233: fix external entity infinite loop in entityValueInitProcessor\n and entityValueProcessor\n- CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of\n large tokens in small buffer refills; fix buffer growth calculation\n- CVE-2013-0340: add billion laughs (entity expansion bomb)\n attack protection with amplification limit (100x max, 8 MiB activation\n threshold); includes fix for isolated external parser bypass (CVE-2024-28757)\n- CVE-2024-28757: add billion laughs (entity expansion bomb)\n attack protection with amplification limit (100x max, 8 MiB activation\n threshold); includes fix for isolated external parser bypass (CVE-2024-28757)","status":"published","published":"2026-04-20T09:17:20Z","modified":"2026-10-21T10:48:14.29219416Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"MGASA-2024-0072","title":"Updated expat packages fix security vulnerabilities","description":"It was discovered that Expat could be made to consume large amounts of\nresources. If a user or automated system were tricked into processing\nspecially crafted input, an attacker could possibly use this issue to\ncause\na denial of service. (CVE-2023-52425, CVE-2024-28757)\n","status":"published","published":"2024-03-18T16:12:23Z","modified":"2026-04-16T04:42:45.427531849Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13779-1","title":"expat-2.6.2-1.1 on GA media","description":"These are all security issues fixed in the expat-2.6.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:20:46.852151Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:1129-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2023-52425: Fixed a DoS caused by processing large tokens. (bsc#1219559) \n- CVE-2024-28757: Fixed an XML Entity Expansion. (bsc#1221289)\n","status":"published","published":"2024-04-08T07:12:10Z","modified":"2026-02-04T04:30:10.425153Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:1129-2","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2023-52425: Fixed a DoS caused by processing large tokens. (bsc#1219559) \n- CVE-2024-28757: Fixed an XML Entity Expansion. (bsc#1221289)\n","status":"published","published":"2024-04-08T07:12:27Z","modified":"2026-02-04T02:23:53.849509Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2025:20045-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2024-45492: detect integer overflow in function nextScaffoldPart (bsc#1229932) \n- CVE-2024-45491: detect integer overflow in dtdCopy (bsc#1229931)\n- CVE-2024-45490: reject negative len for XML_ParseBuffer (bsc#1229930)\n- CVE-2024-28757: XML Entity Expansion attack when there is isolated use of external parsers (bsc#1221289) \n","status":"published","published":"2025-02-03T08:54:55Z","modified":"2026-03-23T04:50:41.184265Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20207-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\nVersion update to 2.7.1:\n\n* Bug fixes:\n\n * Restore event pointer behavior from Expat 2.6.4 (that the fix to CVE-2024-8176 changed in 2.7.0);\n affected API functions are:\n\n - XML_GetCurrentByteCount\n - XML_GetCurrentByteIndex\n - XML_GetCurrentColumnNumber\n - XML_GetCurrentLineNumber\n - XML_GetInputContext\n\n * Other changes:\n #976 #977 Autotools: Integrate files \"fuzz/xml_lpm_fuzzer.{cpp,proto}\"\n with Automake that were missing from 2.7.0 release tarballs\n #983 #984 Fix printf format specifiers for 32bit Emscripten\n #992 docs: Promote OpenSSF Best Practices self-certification\n #978 tests/benchmark: Resolve mistaken double close\n #986 Address compiler warnings\n #990 #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1)\n to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/\n for what these numbers do\n\n Infrastructure:\n #982 CI: Start running Perl XML::Parser integration tests\n #987 CI: Enforce Clang Static Analyzer clean code\n #991 CI: Re-enable warning clang-analyzer-valist.Uninitialized\n for clang-tidy\n #981 CI: Cover compilation with musl\n #983 #984 CI: Cover compilation with 32bit Emscripten\n #976 #977 CI: Protect against fuzzer files missing from future\n release archives\n\nVersion update to 2.7.0 (CVE-2024-8176 [bsc#1239618])\n\n* Security fixes:\n * CVE-2024-8176 -- Fix crash from chaining a large number\n of entities caused by stack overflow by resolving use of\n recursion, for all three uses of entities:\n - general entities in character data (\"\u003ce\u003e\u0026g1;\u003c/e\u003e\")\n - general entities in attribute values (\"\u003ce k1='\u0026g1;'/\u003e\")\n - parameter entities (\"%p1;\")\n\n Known impact is (reliable and easy) denial of service:\n\n CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C\n\n (Base Score: 7.5, Temporal Score: 7.2)\n\n Please note that a layer of compression around XML can\n significantly reduce the minimum attack payload size.\n\n * Other changes:\n * Document changes since the previous release\n * Version info bumped from 11:0:10 (libexpat*.so.1.10.0)\n to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/\n for what these numbers do\n\nVersion update to 2.6.4:\n\n * Security fixes: [bsc#1232601][bsc#1232579]\n * CVE-2024-50602 -- Fix crash within function XML_ResumeParser\n from a NULL pointer dereference by disallowing function\n XML_StopParser to (stop or) suspend an unstarted parser.\n A new error code XML_ERROR_NOT_STARTED was introduced to\n properly communicate this situation. // CWE-476 CWE-754\n * Other changes:\n * Version info bumped from 10:3:9 (libexpat*.so.1.9.3)\n to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/\n for what these numbers do\n\nUpdate to 2.6.3:\n\n * Security fixes:\n - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with\n len \u003c 0 without noticing and then calling XML_GetBuffer\n will have XML_ParseBuffer fail to recognize the problem\n and XML_GetBuffer corrupt memory.\n With the fix, XML_ParseBuffer now complains with error\n XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse\n has been doing since Expat 2.2.1, and now documented.\n Impact is denial of service to potentially artitrary code\n execution.\n - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an\n integer overflow for nDefaultAtts on 32-bit platforms\n (where UINT_MAX equals SIZE_MAX).\n Impact is denial of service to potentially artitrary code\n execution.\n - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can\n have an integer overflow for m_groupSize on 32-bit\n platforms (where UINT_MAX equals SIZE_MAX).\n Impact is denial of service to potentially artitrary code\n execution.\n\n * Other changes:\n\n - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)\n to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/\n for what these numbers do \n\nUpdate to 2.6.2:\n\n * CVE-2024-28757 -- Prevent billion laughs attacks with isolated\n use of external parsers (bsc#1221289)\n * Reject direct parameter entity recursion and avoid the related\n undefined behavior\n\nUpdate to 2.6.1:\n\n * Expose billion laughs API with XML_DTD defined and XML_GE\n undefined, regression from 2.6.0\n * Make tests independent of CPU speed, and thus more robust\n\nUpdate to 2.6.0: \n\n * Security fixes:\n - CVE-2023-52425 (bsc#1219559) \n Fix quadratic runtime issues with big tokens\n that can cause denial of service, in partial where\n dealing with compressed XML input. Applications\n that parsed a document in one go -- a single call to\n functions XML_Parse or XML_ParseBuffer -- were not affected.\n The smaller the chunks/buffers you use for parsing\n previously, the bigger the problem prior to the fix.\n Backporters should be careful to no omit parts of\n pull request #789 and to include earlier pull request #771,\n in order to not break the fix.\n - CVE-2023-52426 (bsc#1219561)\n Fix billion laughs attacks for users\n compiling *without* XML_DTD defined (which is not common).\n Users with XML_DTD defined have been protected since\n Expat \u003e=2.4.0 (and that was CVE-2013-0340 back then).\n * Bug fixes:\n - Fix parse-size-dependent \"invalid token\" error for\n external entities that start with a byte order mark\n - Fix NULL pointer dereference in setContext via\n XML_ExternalEntityParserCreate for compilation with\n XML_DTD undefined\n - Protect against closing entities out of order\n * Other changes:\n - Improve support for arc4random/arc4random_buf\n - Improve buffer growth in XML_GetBuffer and XML_Parse\n - xmlwf: Support --help and --version\n - xmlwf: Support custom buffer size for XML_GetBuffer and read\n - xmlwf: Improve language and URL clickability in help output\n - examples: Add new example \"element_declarations.c\"\n - Be stricter about macro XML_CONTEXT_BYTES at build time\n - Make inclusion to expat_config.h consistent\n - Autotools: configure.ac: Support --disable-maintainer-mode\n - Autotools: Sync CMake templates with CMake 3.26\n - Autotools: Make installation of shipped man page doc/xmlwf.1\n independent of docbook2man availability\n - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file\n section \"Cflags.private\" in order to fix compilation\n against static libexpat using pkg-config on Windows\n - Autotools|CMake: Require a C99 compiler\n (a de-facto requirement already since Expat 2.2.2 of 2017)\n - Autotools|CMake: Fix PACKAGE_BUGREPORT variable\n - Autotools|CMake: Make test suite require a C++11 compiler\n - CMake: Require CMake \u003e=3.5.0\n - CMake: Lowercase off_t and size_t to help a bug in Meson\n - CMake: Sort xmlwf sources alphabetically\n - CMake|Windows: Fix generation of DLL file version info\n - CMake: Build tests/benchmark/benchmark.c as well for\n a build with -DEXPAT_BUILD_TESTS=ON\n - docs: Document the importance of isFinal + adjust tests\n accordingly\n - docs: Improve use of \"NULL\" and \"null\"\n - docs: Be specific about version of XML (XML 1.0r4)\n and version of C (C99); (XML 1.0r5 will need a sponsor.)\n - docs: reference.html: Promote function XML_ParseBuffer more\n - docs: reference.html: Add HTML anchors to XML_* macros\n - docs: reference.html: Upgrade to OK.css 1.2.0\n - docs: Fix typos\n - docs|CI: Use HTTPS URLs instead of HTTP at various places\n - Address compiler warnings\n - Address clang-tidy warnings\n - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)\n to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/\n for what these numbers do\n","status":"published","published":"2025-04-29T11:07:45Z","modified":"2026-03-23T04:50:04.767104Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20311-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\nVersion update to 2.7.1:\n\n Bug fixes:\n\n #980 #989 Restore event pointer behavior from Expat 2.6.4\n (that the fix to CVE-2024-8176 changed in 2.7.0);\n affected API functions are:\n - XML_GetCurrentByteCount\n - XML_GetCurrentByteIndex\n - XML_GetCurrentColumnNumber\n - XML_GetCurrentLineNumber\n - XML_GetInputContext\n\n Other changes:\n\n #976 #977 Autotools: Integrate files \"fuzz/xml_lpm_fuzzer.{cpp,proto}\"\n with Automake that were missing from 2.7.0 release tarballs\n #983 #984 Fix printf format specifiers for 32bit Emscripten\n #992 docs: Promote OpenSSF Best Practices self-certification\n #978 tests/benchmark: Resolve mistaken double close\n #986 Address compiler warnings\n #990 #993 Version info bumped from 11:1:10 (libexpat*.so.1.10.1)\n to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/\n for what these numbers do\n\n Infrastructure:\n\n #982 CI: Start running Perl XML::Parser integration tests\n #987 CI: Enforce Clang Static Analyzer clean code\n #991 CI: Re-enable warning clang-analyzer-valist.Uninitialized\n for clang-tidy\n #981 CI: Cover compilation with musl\n #983 #984 CI: Cover compilation with 32bit Emscripten\n #976 #977 CI: Protect against fuzzer files missing from future\n release archives\n\nversion update to 2.7.0 (CVE-2024-8176 [bsc#1239618]):\n\n * Security fixes:\n\n #893 #973 CVE-2024-8176 -- Fix crash from chaining a large number\n of entities caused by stack overflow by resolving use of\n recursion, for all three uses of entities:\n - general entities in character data (\"\u003ce\u003e\u0026g1;\u003c/e\u003e\")\n - general entities in attribute values (\"\u003ce k1='\u0026g1;'/\u003e\")\n - parameter entities (\"%p1;\")\n Known impact is (reliable and easy) denial of service:\n CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C\n (Base Score: 7.5, Temporal Score: 7.2)\n Please note that a layer of compression around XML can\n significantly reduce the minimum attack payload size.\n\n * Other changes:\n #935 #937 Autotools: Make generated CMake files look for\n libexpat.@SO_MAJOR@.dylib on macOS\n #925 Autotools: Sync CMake templates with CMake 3.29\n #945 #962 #966 CMake: Drop support for CMake \u003c3.13\n #942 CMake: Small fuzzing related improvements\n #921 docs: Add missing documentation of error code\n XML_ERROR_NOT_STARTED that was introduced with 2.6.4\n #941 docs: Document need for C++11 compiler for use from C++\n #959 tests/benchmark: Fix a (harmless) TOCTTOU\n #944 Windows: Fix installer target location of file xmlwf.xml\n for CMake\n #953 Windows: Address warning -Wunknown-warning-option\n about -Wno-pedantic-ms-format from LLVM MinGW\n #971 Address Cppcheck warnings\n #969 #970 Mass-migrate links from http:// to https://\n #947 #958 ..\n #974 #975 Document changes since the previous release\n #974 #975 Version info bumped from 11:0:10 (libexpat*.so.1.10.0)\n to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/\n for what these numbers do\n\n- no source changes, just adding jira reference: jsc#SLE-21253\n\nVersion update to 2.6.4 \n\n * Security fixes: [bsc#1232601][bsc#1232579]\n #915 CVE-2024-50602 -- Fix crash within function XML_ResumeParser\n from a NULL pointer dereference by disallowing function\n XML_StopParser to (stop or) suspend an unstarted parser.\n A new error code XML_ERROR_NOT_STARTED was introduced to\n properly communicate this situation. // CWE-476 CWE-754\n * Other changes:\n #903 CMake: Add alias target \"expat::expat\"\n #905 docs: Document use via CMake \u003e=3.18 with FetchContent\n and SOURCE_SUBDIR and its consequences\n #902 tests: Reduce use of global parser instance\n #904 tests: Resolve duplicate handler\n #317 #918 tests: Improve tests on doctype closing (ex CVE-2019-15903)\n #914 Fix signedness of format strings\n #919 #920 Version info bumped from 10:3:9 (libexpat*.so.1.9.3)\n to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/\n for what these numbers do\n\nUpdate to 2.6.3: \n\n * Security fixes:\n\n - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with\n len \u003c 0 without noticing and then calling XML_GetBuffer\n will have XML_ParseBuffer fail to recognize the problem\n and XML_GetBuffer corrupt memory.\n With the fix, XML_ParseBuffer now complains with error\n XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse\n has been doing since Expat 2.2.1, and now documented.\n Impact is denial of service to potentially artitrary code\n execution.\n - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an\n integer overflow for nDefaultAtts on 32-bit platforms\n (where UINT_MAX equals SIZE_MAX).\n Impact is denial of service to potentially artitrary code\n execution.\n - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can\n have an integer overflow for m_groupSize on 32-bit\n platforms (where UINT_MAX equals SIZE_MAX).\n Impact is denial of service to potentially artitrary code\n execution.\n\nUpdate to 2.6.2:\n\n * CVE-2024-28757 -- Prevent billion laughs attacks with isolated\n use of external parsers (bsc#1221289)\n * Reject direct parameter entity recursion and avoid the related\n undefined behavior\n\nUpdate to 2.6.1:\n\n * Expose billion laughs API with XML_DTD defined and XML_GE\n undefined, regression from 2.6.0\n * Make tests independent of CPU speed, and thus more robust\n\nUpdate to 2.6.0: \n\n * Security fixes:\n - CVE-2023-52425 (bsc#1219559) \n -- Fix quadratic runtime issues with big tokens\n that can cause denial of service, in partial where\n dealing with compressed XML input. Applications\n that parsed a document in one go -- a single call to\n functions XML_Parse or XML_ParseBuffer -- were not affected.\n The smaller the chunks/buffers you use for parsing\n previously, the bigger the problem prior to the fix.\n Backporters should be careful to no omit parts of\n pull request #789 and to include earlier pull request #771,\n in order to not break the fix.\n - CVE-2023-52426 (bsc#1219561)\n -- Fix billion laughs attacks for users\n compiling *without* XML_DTD defined (which is not common).\n Users with XML_DTD defined have been protected since\n Expat \u003e=2.4.0 (and that was CVE-2013-0340 back then).\n * Bug fixes:\n - Fix parse-size-dependent \"invalid token\" error for\n external entities that start with a byte order mark\n - Fix NULL pointer dereference in setContext via\n XML_ExternalEntityParserCreate for compilation with\n XML_DTD undefined\n - Protect against closing entities out of order\n * Other changes:\n - Improve support for arc4random/arc4random_buf\n - Improve buffer growth in XML_GetBuffer and XML_Parse\n - xmlwf: Support --help and --version\n - xmlwf: Support custom buffer size for XML_GetBuffer and read\n - xmlwf: Improve language and URL clickability in help output\n - examples: Add new example \"element_declarations.c\"\n - Be stricter about macro XML_CONTEXT_BYTES at build time\n - Make inclusion to expat_config.h consistent\n - Autotools: configure.ac: Support --disable-maintainer-mode\n - Autotools: Sync CMake templates with CMake 3.26\n - Autotools: Make installation of shipped man page doc/xmlwf.1\n independent of docbook2man availability\n - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file\n section \"Cflags.private\" in order to fix compilation\n against static libexpat using pkg-config on Windows\n - Autotools|CMake: Require a C99 compiler\n (a de-facto requirement already since Expat 2.2.2 of 2017)\n - Autotools|CMake: Fix PACKAGE_BUGREPORT variable\n - Autotools|CMake: Make test suite require a C++11 compiler\n - CMake: Require CMake \u003e=3.5.0\n - CMake: Lowercase off_t and size_t to help a bug in Meson\n - CMake: Sort xmlwf sources alphabetically\n - CMake|Windows: Fix generation of DLL file version info\n - CMake: Build tests/benchmark/benchmark.c as well for\n a build with -DEXPAT_BUILD_TESTS=ON\n - docs: Document the importance of isFinal + adjust tests\n accordingly\n - docs: Improve use of \"NULL\" and \"null\"\n - docs: Be specific about version of XML (XML 1.0r4)\n and version of C (C99); (XML 1.0r5 will need a sponsor.)\n - docs: reference.html: Promote function XML_ParseBuffer more\n - docs: reference.html: Add HTML anchors to XML_* macros\n - docs: reference.html: Upgrade to OK.css 1.2.0\n - docs: Fix typos\n - docs|CI: Use HTTPS URLs instead of HTTP at various places\n - Address compiler warnings\n - Address clang-tidy warnings\n - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)\n to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/\n for what these numbers do\n","status":"published","published":"2025-05-13T13:37:27Z","modified":"2026-03-23T04:50:06.711026Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-6694-1","title":"expat vulnerabilities","description":"It was discovered that Expat could be made to consume large amounts of\nresources. If a user or automated system were tricked into processing\nspecially crafted input, an attacker could possibly use this issue to cause\na denial of service. (CVE-2023-52425, CVE-2024-28757)\n","status":"published","published":"2024-03-14T10:19:40Z","modified":"2026-04-27T17:08:00.988768Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}