{"id":"CVE-2024-50602","aliases":["ALPINE-CVE-2024-50602","ALSA-2024:9502","ALSA-2024:9541","AZL-51684","AZL-51735","BELL-CVE-2024-50602","BIT-libpython-2024-50602","BIT-python-2024-50602","BIT-python-min-2024-50602","CLSA-2024-1732197848","CLSA-2024-1732197865","CLSA-2024-1732197974","CLSA-2024-1732553483","CLSA-2024-1735128527","CLSA-2024-1735128985","CLSA-2026-1776243051","CLSA-2026-1778895199","DEBIAN-CVE-2024-50602","DLA-4145-1","EUVD-2024-44973","GHSA-79wf-qgrg-2p6c","JLSEC-2025-65","MGASA-2024-0362","MGASA-2024-0396","OESA-2024-2311","RHSA-2024:11200","RHSA-2024:9502","RHSA-2024:9541","RHSA-2025:3350","RLSA-2024:9502","SUSE-SU-2024:3964-1","SUSE-SU-2024:3966-1","SUSE-SU-2024:3968-1","SUSE-SU-2024:3997-1","SUSE-SU-2024:4035-1","SUSE-SU-2024:4411-1","SUSE-SU-2024:4412-1","SUSE-SU-2025:20086-1","SUSE-SU-2025:20207-1","SUSE-SU-2025:20258-1","SUSE-SU-2025:20311-1","SUSE-SU-2025:4512-1","SUSE-SU-2026:0044-1","UBUNTU-CVE-2024-50602","USN-7145-1","openSUSE-SU-2024:14443-1","openSUSE-SU-2024:14444-1","openSUSE-SU-2024:14457-1","openSUSE-SU-2024:14477-1","openSUSE-SU-2024:14587-1","openSUSE-SU-2024:14588-1","openSUSE-SU-2024:14589-1","openSUSE-SU-2024:14609-1"],"status":"published","title":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser...","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01117,"percentile":0.66361,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-754"],"published":"2024-10-27T00:00:00Z","modified":"2026-11-03T06:33:00Z","exploits":[{"source":"pocgithub","id":"MaineK00n/vulncheck_CVE-2024-50602","title":"MaineK00n/vulncheck_CVE-2024-50602","date":"2026-02-03","url":"https://github.com/MaineK00n/vulncheck_CVE-2024-50602"}],"fixes":[{"ecosystem":"Alpine:v3.17","package":"expat","fixed_in":["2.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"expat","fixed_in":["2.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"expat","fixed_in":["2.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"expat","fixed_in":["2.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"expat","fixed_in":["2.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"expat","fixed_in":["2.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"expat","fixed_in":["2.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"expat","fixed_in":["2.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"qt6-qtwebengine","fixed_in":["6.8.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"qt6-qtwebengine","fixed_in":["6.8.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"qt6-qtwebengine","fixed_in":["6.8.3-r1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"expat","fixed_in":["2.2.5-16.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"expat-devel","fixed_in":["2.2.5-16.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"expat","fixed_in":["2.5.0-3.el9_5.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"expat-devel","fixed_in":["2.5.0-3.el9_5.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"expat","fixed_in":["2.6.3-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"expat","fixed_in":["2.6.3-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"expat","fixed_in":["2.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"expat","fixed_in":["2.6.4-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"expat","fixed_in":["2.6.4-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"expat","fixed_in":["2.6.4-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"libpython","fixed_in":["3.9.21","3.10.16","3.11.11","3.12.8","3.13.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python","fixed_in":["3.9.21","3.10.16","3.11.11","3.12.8","3.13.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"python-min","fixed_in":["3.9.21","3.10.16","3.11.11","3.12.8","3.13.1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"expat","fixed_in":["2.2.5-13.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"expat-devel","fixed_in":["2.2.5-13.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"expat-static","fixed_in":["2.2.5-13.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"expat","fixed_in":["2.2.5-13.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"expat-devel","fixed_in":["2.2.5-13.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"expat-static","fixed_in":["2.2.5-13.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"expat","fixed_in":["2.2.5-13.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-devel","fixed_in":["2.2.5-13.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-static","fixed_in":["2.2.5-13.el8.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat","fixed_in":["2.5.0-1.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-devel","fixed_in":["2.5.0-1.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-static","fixed_in":["2.5.0-1.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"expat","fixed_in":["2.1.0-7ubuntu0.16.04.5+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1","fixed_in":["2.1.0-7ubuntu0.16.04.5+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1-dev","fixed_in":["2.1.0-7ubuntu0.16.04.5+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"expat","fixed_in":["2.2.5-3ubuntu0.9+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libexpat1","fixed_in":["2.2.5-3ubuntu0.9+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libexpat1-dev","fixed_in":["2.2.5-3ubuntu0.9+tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"expat","fixed_in":["2.2.6-2+deb10u7+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libexpat1","fixed_in":["2.2.6-2+deb10u7+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Debian:10","package":"libexpat1-dev","fixed_in":["2.2.6-2+deb10u7+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"expat","fixed_in":["2.5.0-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.6.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.6.3-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"expat","fixed_in":["2.2.10-2+deb11u7"],"sources":["osv"]},{"ecosystem":"Julia","package":"Expat_jll","fixed_in":["2.6.4+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"expat","fixed_in":["2.6.4-1.mga9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"mozjs78","fixed_in":["78.15.0-7.2.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"expat","fixed_in":["2.4.1-13.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"expat","fixed_in":["2.5.0-7.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"expat","fixed_in":["2.4.1-14.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"expat","fixed_in":["2.4.1-13.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"expat","fixed_in":["2.2.9-14.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"expat-debuginfo","fixed_in":["0:2.5.0-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"expat-debugsource","fixed_in":["0:2.5.0-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"expat-devel","fixed_in":["0:2.5.0-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"expat","fixed_in":["0:2.5.0-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"expat-debuginfo","fixed_in":["0:2.5.0-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"expat-debugsource","fixed_in":["0:2.5.0-2.el9_4.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat","fixed_in":["0:2.2.5-16.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debuginfo","fixed_in":["0:2.2.5-16.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debugsource","fixed_in":["0:2.2.5-16.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-devel","fixed_in":["0:2.2.5-16.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debuginfo","fixed_in":["0:2.5.0-3.el9_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debugsource","fixed_in":["0:2.5.0-3.el9_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-devel","fixed_in":["0:2.5.0-3.el9_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat","fixed_in":["0:2.5.0-3.el9_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debuginfo","fixed_in":["0:2.5.0-3.el9_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debugsource","fixed_in":["0:2.5.0-3.el9_5.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"expat-debuginfo","fixed_in":["0:2.5.0-1.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"expat-debugsource","fixed_in":["0:2.5.0-1.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"expat-devel","fixed_in":["0:2.5.0-1.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"expat","fixed_in":["0:2.5.0-1.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"expat-debuginfo","fixed_in":["0:2.5.0-1.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"expat-debugsource","fixed_in":["0:2.5.0-1.el9_2.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"expat","fixed_in":["0:2.2.5-16.el8_10"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python311-wxPython","fixed_in":["4.1.1-150400.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"expat","fixed_in":["2.2.5-150000.3.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"expat","fixed_in":["2.2.5-150000.3.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"expat","fixed_in":["2.1.0-21.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"python3-wxPython","fixed_in":["4.1.1-150400.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python3-wxPython","fixed_in":["4.1.1-150400.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python3-wxPython","fixed_in":["4.1.1-150400.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python3-wxPython","fixed_in":["4.1.1-150400.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"expat","fixed_in":["2.4.4-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"expat","fixed_in":["2.4.4-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"expat","fixed_in":["2.4.4-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"expat","fixed_in":["2.4.4-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"expat","fixed_in":["2.4.4-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.5","package":"expat","fixed_in":["2.4.4-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"expat","fixed_in":["2.4.4-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"expat","fixed_in":["2.4.4-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"mozjs78","fixed_in":["78.15.0-150400.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"mozjs78","fixed_in":["78.15.0-150400.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"mozjs78","fixed_in":["78.15.0-150400.3.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"mozjs78","fixed_in":["78.15.0-150400.3.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"mozjs78","fixed_in":["78.15.0-150400.3.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"expat","fixed_in":["2.5.0-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"expat","fixed_in":["2.5.0-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","fixed_in":["2.1.0-4ubuntu1.4+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","fixed_in":["2.1.0-7ubuntu0.16.04.5+esm10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","fixed_in":["2.2.5-3ubuntu0.9+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"expat","fixed_in":["2.2.9-1ubuntu0.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"expat","fixed_in":["2.4.7-1ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"expat","fixed_in":["2.6.1-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xsd","fixed_in":["4.1.0-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gama","fixed_in":["2.31-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"audacity","fixed_in":["3.7.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"expat","fixed_in":["2.6.4-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mozjs115","fixed_in":["115.15.0-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mozjs128","fixed_in":["128.5.1-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mozjs78","fixed_in":["78.15.0-7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"paraview","fixed_in":["5.12.1-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"qt6-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"qt6-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"qt6-qtwebengine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.3-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-16.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-16.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-3.el9_5.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-3.el9_5.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.3-r0"},{"fixed":"2.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.3-r0"},{"fixed":"2.6.4-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.3-r0"},{"fixed":"2.6.4-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.3-r0"},{"fixed":"2.6.4-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"libpython","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.9.21"},{"introduced":"3.10.0"},{"fixed":"3.10.16"},{"introduced":"3.11.0"},{"fixed":"3.11.11"},{"introduced":"3.12.0"},{"fixed":"3.12.8"},{"introduced":"3.13.0"},{"fixed":"3.13.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.9.21"},{"introduced":"3.10.0"},{"fixed":"3.10.16"},{"introduced":"3.11.0"},{"fixed":"3.11.11"},{"introduced":"3.12.0"},{"fixed":"3.12.8"},{"introduced":"3.13.0"},{"fixed":"3.13.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"python-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.9.21"},{"introduced":"3.10.0"},{"fixed":"3.10.16"},{"introduced":"3.11.0"},{"fixed":"3.11.11"},{"introduced":"3.12.0"},{"fixed":"3.12.8"},{"introduced":"3.13.0"},{"fixed":"3.13.1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-13.el8.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libexpat1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libexpat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libexpat1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.6.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.6.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.6.el7_9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libexpat1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libexpat1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6-2+deb10u7+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1+deb12u2"}]}],"versions":["2.5.0-1","2.5.0-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.3-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4.1","1.2-4.1~exp1","1.2-4.2"]},{"source":"osv","ecosystem":"Debian:11","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u7"}]}],"versions":["2.2.10-2","2.2.10-2+deb11u1","2.2.10-2+deb11u2","2.2.10-2+deb11u3","2.2.10-2+deb11u4","2.2.10-2+deb11u5","2.2.10-2+deb11u6"]},{"source":"osv","ecosystem":"Julia","package":"Expat_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-1.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-7.2.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-13.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-7.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-14.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-13.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-14.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-2.el9_4.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-16.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-16.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-16.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-16.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-3.el9_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-3.el9_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-3.el9_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-3.el9_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-3.el9_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-3.el9_5.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el9_2.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-16.el8_10"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python311-wxPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-150400.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-150000.3.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-21.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"python3-wxPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-150400.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python3-wxPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-150400.10.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python3-wxPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-150400.10.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python3-wxPython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.1-150400.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.4.0-150600.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.4.0-150600.3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-150400.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-150400.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-150400.3.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-150400.3.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-150400.3.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-slfo.1.1_1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.6.0-150000.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.6.0-150000.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"mozjs60","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-150200.6.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"mozjs60","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-150200.6.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"mozjs60","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-150200.6.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"mozjs60","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-150200.6.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"mozjs60","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-150200.6.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"mozjs60","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.9.0-150200.6.8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50-3","3.1.4~abc9f50-4","3.1.4~abc9f50-4ubuntu2","3.1.4~abc9f50-4ubuntu2+esm1","3.1.4~abc9f50-4ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm10"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4","2.1.0-4ubuntu1.4+esm6","2.1.0-4ubuntu1.4+esm7","2.1.0-4ubuntu1.4+esm8","2.1.0-4ubuntu1.4+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37ubuntu5","4.1.1+xorg4.3.0-37ubuntu5.0.1","4.1.1+xorg4.3.0-37ubuntu5.0.2","4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14ubuntu1","5.8.0-14ubuntu3","5.8.0-14.1ubuntu2","5.8.0-14.1ubuntu3","5.8.0-14.1ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.33-3.2ubuntu3","1.33.06-0ubuntu1","1.33.06-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm10"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2","2.1.0-7ubuntu0.16.04.5+esm5","2.1.0-7ubuntu0.16.04.5+esm6","2.1.0-7ubuntu0.16.04.5+esm7","2.1.0-7ubuntu0.16.04.5+esm8","2.1.0-7ubuntu0.16.04.5+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ayttm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.3-3build1","0.6.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cableswig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0+git20150808-1","0.1.0+git20150808-2","0.1.0+git20150808-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.4-4","2.4.4-4build1","2.4.4-4ubuntu1","2.6.1-3","2.6.2-1","2.6.2-2","2.6.2-3","2.6.3-1","2.6.3-1ubuntu1","2.6.3-2ubuntu1","2.6.3-3ubuntu1","2.6.3-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1ubuntu3","4.8.1-1ubuntu4","4.8.2-3.1ubuntu1","4.9.0-3ubuntu2","4.9.0-4ubuntu1","4.9.0-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-4","2.4.7-4build1","2.4.7-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2","4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.1+dfsg-2","5.10.1+dfsg-2build3","5.10.1+dfsg-2.1build1","5.10.1+dfsg-2.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-0.2ubuntu3","1.33.14-1ubuntu1","1.33.14-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+esm2"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7","2.2.5-3ubuntu0.8","2.2.5-3ubuntu0.9","2.2.5-3ubuntu0.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-2","3.1.4~abc9f50+dfsg2-1","3.1.4~abc9f50+dfsg3-1","3.1.4~abc9f50+dfsg3-2","3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-3build1","2.8.3-1","2.8.4-1","2.8.4-1build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5build1","0.13+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-5ubuntu1","2.4.7-5ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1","0.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-7","1.33.14-8","1.33.14-8build1","1.33.14-8ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.8"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4","2.2.9-1ubuntu0.5","2.2.9-1ubuntu0.6","2.2.9-1ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-4.1ubuntu1","4.13.2-dfsg1-1ubuntu1","4.13.2-dfsg1-4ubuntu1","4.13.2-dfsg1-6","4.13.2-dfsg1-6ubuntu1","4.13.2-dfsg1-8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-6","0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build1","2.4.7-6build2","2.4.7-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-8build1","1.33.14-8build2","1.33.14-8ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.5"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1","2.4.7-1ubuntu0.2","2.4.7-1ubuntu0.3","2.4.7-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.3withdata-dfsg1-4.1","4.13.3withdata-dfsg2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1","0.11.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build3","2.4.7-6.1","2.4.7-6.1build1","2.4.7-6.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-9","1.33.14-10","1.33.14-10ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24+dfsg-2","0.24+dfsg-3","0.24+dfsg-3build1","0.24+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2ubuntu0.2"}]}],"versions":["2.5.0-2","2.6.0-1","2.6.1-2","2.6.1-2build1","2.6.1-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1","0.13+ds2-1build1","0.13+ds2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.3-1","0.9.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.8+dfsg-3","0.11.8+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.2","2.4.7-6.2build1","2.4.7-6.2build2","2.4.7-6.2build3","2.4.7-6.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-11","1.33.14-11.1","1.33.14-12","1.33.14-12build1","1.33.14-12build2","1.33.14-12ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.3","2.4.7-6.3build1","2.4.7-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-2","0.9.5.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-7","1.59.03-9","1.59.03-10","1.59.03-10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7.1","2.4.7-7.2","2.4.7-7.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-2","0.9.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-3","0.11.10+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.05-1","1.60.05-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2","0.28+dfsg-1","0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2","0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-3","0.9.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2","0.11.10+dfsg-2build1","0.11.10+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-10.1","1.60.05-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7","2.4.7-7.1","2.4.7-7.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm10"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4","2.1.0-4ubuntu1.4+esm6","2.1.0-4ubuntu1.4+esm7","2.1.0-4ubuntu1.4+esm8","2.1.0-4ubuntu1.4+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm10"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2","2.1.0-7ubuntu0.16.04.5+esm5","2.1.0-7ubuntu0.16.04.5+esm6","2.1.0-7ubuntu0.16.04.5+esm7","2.1.0-7ubuntu0.16.04.5+esm8","2.1.0-7ubuntu0.16.04.5+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+esm2"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7","2.2.5-3ubuntu0.8","2.2.5-3ubuntu0.9","2.2.5-3ubuntu0.9+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.8"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4","2.2.9-1ubuntu0.5","2.2.9-1ubuntu0.6","2.2.9-1ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.5"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1","2.4.7-1ubuntu0.2","2.4.7-1ubuntu0.3","2.4.7-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2ubuntu0.2"}]}],"versions":["2.5.0-2","2.6.0-1","2.6.1-2","2.6.1-2build1","2.6.1-2ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gama","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"audacity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"115.15.0-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.5.1-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.15.0-7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"paraview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.12.1-2.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"libexpat_project","product":"libexpat"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410c_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"hci_compute_node"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_storage_node"},{"vendor":"netapp","product":"windows_host_utilities"},{"vendor":"siemens","product":"ruggedcom rox mx5000"},{"vendor":"siemens","product":"ruggedcom rox mx5000re"},{"vendor":"siemens","product":"ruggedcom rox rx1400"},{"vendor":"siemens","product":"ruggedcom rox rx1500"},{"vendor":"siemens","product":"ruggedcom rox rx1501"},{"vendor":"siemens","product":"ruggedcom rox rx1510"},{"vendor":"siemens","product":"ruggedcom rox rx1511"},{"vendor":"siemens","product":"ruggedcom rox rx1512"},{"vendor":"siemens","product":"ruggedcom rox rx1524"},{"vendor":"siemens","product":"ruggedcom rox rx1536"},{"vendor":"siemens","product":"ruggedcom rox rx5000"},{"vendor":"siemens","product":"ruggedcom rst2428p"},{"vendor":"siemens","product":"scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family"},{"vendor":"siemens","product":"scalance xcm-/xrm-/xch-/xrh-300 family"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://github.com/libexpat/libexpat/pull/915","tags":["Issue Tracking","report","fix","web","article"]},{"url":"https://security.netapp.com/advisory/ntap-20250404-0008/","tags":["Third Party Advisory","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00040.html","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-355557.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-202008.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50602","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250404-0008"},{"url":"https://github.com/advisories/GHSA-79wf-qgrg-2p6c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-50602","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9502","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-50602","tags":["report"]},{"url":"https://bugzilla.redhat.com/2321987","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-9502.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9541","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9541.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-50602","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-61","tags":["advisory"]},{"url":"https://docs.python.org/release/3.10.16/whatsnew/changelog.html","tags":["web"]},{"url":"https://docs.python.org/release/3.11.11/whatsnew/changelog.html#python-3-11-11","tags":["web"]},{"url":"https://docs.python.org/release/3.12.8/whatsnew/changelog.html#python-3-12-8","tags":["web"]},{"url":"https://docs.python.org/release/3.13.1/whatsnew/changelog.html#python-3-13-1","tags":["web"]},{"url":"https://docs.python.org/release/3.9.21/whatsnew/changelog.html","tags":["web"]},{"url":"https://github.com/python/cpython/issues/126623","tags":["web"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2024-1732197848.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2024-1732197865.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos8stream-els/CLSA-2024-1732197974.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2024-1732553483.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1735128527.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1735128985.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1776243051.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1778895199.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50602.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-50602","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0362.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33739","tags":["report"]},{"url":"http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2024\u0026m=slackware-security.358428","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2024-0396.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33864","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/X3V7QAWJ6AWA3YEKX4DEGJFLTQ6ASRC3/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2311","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:11200","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2321987","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_11200.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-50602","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9502.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9541.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3350","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3350.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9502","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243964-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228252","tags":["report"]},{"url":"https://bugzilla.suse.com/1232590","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50602","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243966-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232579","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243968-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243997-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244035-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244411-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1232599","tags":["report"]},{"url":"https://bugzilla.suse.com/1232602","tags":["report"]},{"url":"https://bugzilla.suse.com/1233766","tags":["report"]},{"url":"https://bugzilla.suse.com/1233786","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11498","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244412-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520086-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520207-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219559","tags":["report"]},{"url":"https://bugzilla.suse.com/1219561","tags":["report"]},{"url":"https://bugzilla.suse.com/1221289","tags":["report"]},{"url":"https://bugzilla.suse.com/1229930","tags":["report"]},{"url":"https://bugzilla.suse.com/1229931","tags":["report"]},{"url":"https://bugzilla.suse.com/1229932","tags":["report"]},{"url":"https://bugzilla.suse.com/1232601","tags":["report"]},{"url":"https://bugzilla.suse.com/1239618","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8176","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520258-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520311-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254512-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230036","tags":["report"]},{"url":"https://bugzilla.suse.com/1230037","tags":["report"]},{"url":"https://bugzilla.suse.com/1230038","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260044-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-50602","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7145-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TAVLUAO5K6MJFTEJB4GJPOEFBO7TERI6/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MSPMMPTPAUGVEMQV4WR37XQICDFXWTS7/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SP6G2HGBBIFIEGEE6GB4U2UPVC5XL57H/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5Q6VPY7UYNTWIQZCAPDUIAN2AZRTCYK5/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BKOTUGA2O5N3MZDEKZ6VRDG7KV5LDOGO/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/X3V7QAWJ6AWA3YEKX4DEGJFLTQ6ASRC3/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AH5Z5BJKL2IEXW4VDPEM33Y47PIJHEHX/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-50602","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","status":"published","published":"2024-10-27T00:00:00Z","modified":"2026-10-15T00:58:14.763Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:34:22.153872Z"}],"euvd":[{"id":"EUVD-2024-44973","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","status":"published","published":"2024-10-27T00:00:00Z","modified":"2026-10-15T00:58:14Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:08.661475Z"}],"ghsa":[{"id":"GHSA-79wf-qgrg-2p6c","title":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser...","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","status":"published","published":"2024-10-27T06:30:47Z","modified":"2026-10-15T03:34:16Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T15:13:30.561319Z"}],"nvd":[{"id":"CVE-2024-50602","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","status":"published","published":"2024-10-27T05:15:04.09Z","modified":"2026-10-15T01:19:12.483Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:10:34.877798Z"}],"osv":[{"id":"ALPINE-CVE-2024-50602","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","status":"published","published":"2024-10-27T05:15:04.09Z","modified":"2026-11-03T06:33:00.00507986Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"BELL-CVE-2024-50602","status":"published","published":"2024-10-31T10:13:39.13325Z","modified":"2026-01-26T09:42:41.415826Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:20.963569Z"},{"id":"CVE-2024-50602","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","status":"published","published":"2024-10-27T00:00:00Z","modified":"2026-10-28T02:30:24.197886022Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:44.032344Z"},{"id":"DEBIAN-CVE-2024-50602","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","status":"published","published":"2024-10-27T05:15:04.09Z","modified":"2026-11-02T12:03:06.850104324Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"JLSEC-2025-65","title":"An issue was discovered in libexpat before 2.6.4","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the `XML_ResumeParser` function because `XML_StopParser` can stop/suspend an unstarted parser.","status":"published","published":"2025-10-17T13:28:40.708Z","modified":"2026-07-25T18:23:44.486967727Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2024-2311","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.(CVE-2024-50602)","status":"published","published":"2024-11-01T11:07:47Z","modified":"2026-08-18T01:17:36.412721898Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHSA-2024:11200","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-12-18T10:06:05Z","modified":"2026-06-26T12:22:33.308901016Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:9502","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-11-13T15:28:44Z","modified":"2026-03-18T11:36:24.650486Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:9541","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-11-21T21:55:43Z","modified":"2026-06-26T12:22:23.834576349Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2025:3350","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-03-28T10:04:21Z","modified":"2026-06-26T12:22:34.133117889Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"UBUNTU-CVE-2024-50602","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","status":"published","published":"2024-10-27T05:15:00Z","modified":"2026-10-17T12:56:40.541082547Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"ALSA-2024:9502","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.  \n\nSecurity Fix(es):  \n\n  * libexpat: expat: DoS via XML_ResumeParser (CVE-2024-50602)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-13T00:00:00Z","modified":"2026-10-29T11:02:22.01018486Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:9541","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.  \n\nSecurity Fix(es):  \n\n  * libexpat: expat: DoS via XML_ResumeParser (CVE-2024-50602)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-13T00:00:00Z","modified":"2026-10-29T11:31:53.598656223Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-51684","title":"CVE-2024-50602 affecting package expat for versions less than 2.6.3-2","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","status":"published","published":"2024-10-27T05:15:04Z","modified":"2026-04-21T04:33:14.187765Z","updated_at":"2026-11-02T15:28:06.3228Z"},{"id":"AZL-51735","title":"CVE-2024-50602 affecting package expat for versions less than 2.6.3-2","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","status":"published","published":"2024-10-27T05:15:04Z","modified":"2026-04-21T04:49:58.063585Z","updated_at":"2026-11-02T15:28:06.3228Z"},{"id":"BIT-libpython-2024-50602","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","status":"published","published":"2025-08-11T13:52:47.408Z","modified":"2026-09-08T08:48:09.078084325Z","updated_at":"2026-11-02T15:28:32.162822Z"},{"id":"BIT-python-2024-50602","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","status":"published","published":"2024-12-05T07:15:23.404Z","modified":"2026-09-08T08:48:18.712693939Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"BIT-python-min-2024-50602","description":"An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.","status":"published","published":"2025-01-16T07:19:53.188Z","modified":"2026-09-08T08:48:18.752792897Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"CLSA-2024-1732197848","title":"expat: Fix of CVE-2024-50602","description":"- CVE-2024-50602: Fix crash in XML_ResumeParser function by preventing\n  XML_StopParser from stopping/suspending unstarted parser","status":"published","published":"2024-11-21T14:04:14Z","modified":"2026-06-01T00:33:12.024977665Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1732197865","title":"expat: Fix of CVE-2024-50602","description":"- CVE-2024-50602: Fix crash in XML_ResumeParser function by preventing\n  XML_StopParser from stopping/suspending unstarted parser","status":"published","published":"2024-11-21T14:04:31Z","modified":"2026-06-01T00:33:22.8573592Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1732197974","title":"expat: Fix of CVE-2024-50602","description":"- CVE-2024-50602: Fix crash in XML_ResumeParser function by preventing\n  XML_StopParser from stopping/suspending unstarted parser","status":"published","published":"2024-11-21T14:06:21Z","modified":"2026-06-01T00:32:56.819953467Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1732553483","title":"expat: Fix of CVE-2024-50602","description":"- CVE-2024-50602: Fix crash in XML_ResumeParser by preventing XML_StopParser\n  from stopping/suspending unstarted parser","status":"published","published":"2024-11-25T16:51:29Z","modified":"2026-06-01T00:30:19.729719303Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1735128527","title":"Fix CVE(s): CVE-2024-50602","description":"   * SECURITY UPDATE: Crash in XML_ResumeParser function\n     - debian/patches/CVE-2024-50602.patch: Refuse to stop/suspend an\n       unstarted parser (XML_ERROR_NOT_STARTED). Fix XML_StopParser to be\n       explicit about XML_PARSING and handle default case. Cover\n       XML_StopParser's new handling of status XML_INITIALIZED, Fix crash\n       with NULL pointer dereference in normal_updatePosition\n     - CVE-2024-50602","status":"published","published":"2024-12-25T12:08:53Z","modified":"2026-06-04T10:03:42.606734Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1735128985","title":"Fix CVE(s): CVE-2024-50602","description":"   * SECURITY UPDATE: Crash in XML_ResumeParser due to XML_StopParser issue\n     - debian/patches/CVE-2024-50602.patch: Refuse to stop/suspend an unstarted\n       parser due to XML_ERROR_NOT_STARTED\n     - debian/patches/CVE-2024-50602-1.patch: Explicitly specify XML_PARSING in\n       XML_StopParser to ensure correct parsing status handling\n     - debian/patches/CVE-2024-50602-2.patch: Add test_misc_resumeparser_not_crashing\n       and test_misc_stopparser_rejects_unstarted_parser to cover the issue\n     - CVE-2024-50602","status":"published","published":"2024-12-25T12:16:30Z","modified":"2026-06-04T10:03:30.591076Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2026-1776243051","title":"expat: Fix of 2 CVEs","description":"- CVE-2022-25313: prevent stack exhaustion in build_model\n- CVE-2024-50602: make XML_StopParser refuse to stop/suspend an unstarted parser","status":"published","published":"2026-04-16T14:43:01Z","modified":"2026-06-01T00:33:18.327434698Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1778895199","title":"Fix CVE(s): CVE-2024-50602","description":"   * SECURITY UPDATE: Crash in XML_ResumeParser because XML_StopParser\n     can stop/suspend an unstarted parser\n     - debian/patches/CVE-2024-50602.patch: make XML_StopParser refuse\n       to stop/suspend an unstarted parser\n     - CVE-2024-50602","status":"published","published":"2026-05-16T01:33:24Z","modified":"2026-06-04T10:04:29.98711Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DLA-4145-1","title":"expat - security update","status":"published","published":"2025-04-30T00:00:00Z","modified":"2026-03-09T01:21:30.399637Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2024-0362","title":"Updated expat packages fix security vulnerability","description":"An issue was discovered in libexpat before 2.6.4. There is a crash\nwithin the XML_ResumeParser function because XML_StopParser can\nstop/suspend an unstarted parser. (CVE-2024-50602)\n","status":"published","published":"2024-11-12T19:53:59Z","modified":"2026-04-16T04:44:05.426547056Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"MGASA-2024-0396","title":"Updated mozjs78 packages fix security vulnerability","description":"An issue was discovered in libexpat before 2.6.4. There is a crash\nwithin the XML_ResumeParser function because XML_StopParser can\nstop/suspend an unstarted parser. (CVE-2024-50602)\n","status":"published","published":"2024-12-21T20:16:42Z","modified":"2026-04-16T04:42:12.539342929Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14443-1","title":"xsd-4.1.0-3.1 on GA media","description":"These are all security issues fixed in the xsd-4.1.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-30T00:00:00Z","modified":"2026-02-04T03:45:14.571391Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14444-1","title":"gama-2.31-1.1 on GA media","description":"These are all security issues fixed in the gama-2.31-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-10-31T00:00:00Z","modified":"2026-02-04T04:36:55.282622Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14457-1","title":"audacity-3.7.0-1.1 on GA media","description":"These are all security issues fixed in the audacity-3.7.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-04T00:00:00Z","modified":"2026-02-04T04:23:00.184408Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14477-1","title":"expat-2.6.4-1.1 on GA media","description":"These are all security issues fixed in the expat-2.6.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-11-08T00:00:00Z","modified":"2026-02-04T04:16:05.265288Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14587-1","title":"libmozjs-115-0-115.15.0-3.1 on GA media","description":"These are all security issues fixed in the libmozjs-115-0-115.15.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-16T00:00:00Z","modified":"2026-02-04T03:05:52.917531Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14588-1","title":"libmozjs-128-0-128.5.1-2.1 on GA media","description":"These are all security issues fixed in the libmozjs-128-0-128.5.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-16T00:00:00Z","modified":"2026-02-04T03:30:39.750876Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14589-1","title":"libmozjs-78-0-78.15.0-7.1 on GA media","description":"These are all security issues fixed in the libmozjs-78-0-78.15.0-7.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-16T00:00:00Z","modified":"2025-05-07T18:16:21.94411Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14609-1","title":"libparaview5_12-5.12.1-2.1 on GA media","description":"These are all security issues fixed in the libparaview5_12-5.12.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-22T00:00:00Z","modified":"2026-02-04T02:30:27.93858Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"RLSA-2024:9502","title":"Moderate: expat security update","description":"Expat is a C library for parsing XML documents.\n\nSecurity Fix(es):\n\n* libexpat: expat: DoS via XML_ResumeParser (CVE-2024-50602)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-11-19T16:00:48.844671Z","modified":"2026-02-05T06:15:05.100494Z","updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"SUSE-SU-2024:3964-1","title":"Security update for python-wxPython","description":"This update for python-wxPython fixes the following issues:\n\nSecurity issue fixed: \n\n- CVE-2024-50602: Fixed a denial of service in the vendored libexpat's XML_ResumeParser function (bsc#1232590).\n\nNon-security issues fixed:\n\n- rebuilt for python 3.11 (bsc#1228252).\n- add repack script, do not include packaging/ dir in sources\n- Reduce complexity by not rewriting subpackages at all.\n- Appease factory-auto bot about package src name.\n- Add additional patches fixing the situation with Python 3.10\n  compatibility.\n- Split out the TW python3 flavors into multibuild using the\n  python_subpackage_only mechanism: Multiple python3 flavors\n  sequentially require too much space and time in one build.\n","status":"published","published":"2024-11-09T16:39:53Z","modified":"2026-02-04T02:34:06.801389Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3966-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2024-50602: Fixed a denial of service via XML_ResumeParser (bsc#1232579).\n","status":"published","published":"2024-11-11T08:34:17Z","modified":"2026-02-04T02:50:23.560914Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3968-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2024-50602: Fixed a denial of service via XML_ResumeParser (bsc#1232579).\n","status":"published","published":"2024-11-11T08:57:56Z","modified":"2026-02-04T04:20:31.382578Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3997-1","title":"Security update for python3-wxPython","description":"This update for python3-wxPython fixes the following issues:\n\n- CVE-2024-50602: Fixed a denial of service in the vendored libexpat's XML_ResumeParser function (bsc#1232590).\n","status":"published","published":"2024-11-15T08:36:30Z","modified":"2025-05-02T04:37:11.857553Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:4035-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2024-50602: Fixed a denial of service via XML_ResumeParser (bsc#1232579).\n","status":"published","published":"2024-11-18T15:23:11Z","modified":"2026-02-04T03:54:23.887153Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:4411-1","title":"Security update for mozjs115","description":"This update for mozjs115 fixes the following issues:\n\n- CVE-2024-11498: Fixed resource exhaustion via Stack overflow in libjxl (bsc#1233786)\n- CVE-2024-11403: Fixed out of Bounds Memory Read/Write in libjxl (bsc#1233766)\n- CVE-2024-50602: Fixed DoS via XML_ResumeParser in libexpat (bsc#1232602)\n","status":"published","published":"2024-12-23T12:45:58Z","modified":"2026-02-04T03:53:40.814623Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2024:4412-1","title":"Security update for mozjs78","description":"This update for mozjs78 fixes the following issues:\n\n  - CVE-2024-50602: Fixed DoS via XML_ResumeParser (bsc#1232599)\n\n","status":"published","published":"2024-12-23T13:12:08Z","modified":"2026-02-04T04:34:57.258501Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:20086-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2024-50602: Fixed possible denial-of-service vulnerability inside XML_ResumeParser (bsc#1232579).\n","status":"published","published":"2025-02-03T09:09:12Z","modified":"2026-03-23T04:48:52.361518Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20207-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\nVersion update to 2.7.1:\n\n* Bug fixes:\n\n  * Restore event pointer behavior from Expat 2.6.4 (that the fix to CVE-2024-8176 changed in 2.7.0);\n    affected API functions are:\n\n    - XML_GetCurrentByteCount\n    - XML_GetCurrentByteIndex\n    - XML_GetCurrentColumnNumber\n    - XML_GetCurrentLineNumber\n    - XML_GetInputContext\n\n  * Other changes:\n       #976 #977  Autotools: Integrate files \"fuzz/xml_lpm_fuzzer.{cpp,proto}\"\n                    with Automake that were missing from 2.7.0 release tarballs\n       #983 #984  Fix printf format specifiers for 32bit Emscripten\n            #992  docs: Promote OpenSSF Best Practices self-certification\n            #978  tests/benchmark: Resolve mistaken double close\n            #986  Address compiler warnings\n       #990 #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)\n                    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/\n                    for what these numbers do\n\n        Infrastructure:\n            #982  CI: Start running Perl XML::Parser integration tests\n            #987  CI: Enforce Clang Static Analyzer clean code\n            #991  CI: Re-enable warning clang-analyzer-valist.Uninitialized\n                    for clang-tidy\n            #981  CI: Cover compilation with musl\n       #983 #984  CI: Cover compilation with 32bit Emscripten\n       #976 #977  CI: Protect against fuzzer files missing from future\n                    release archives\n\nVersion update to 2.7.0 (CVE-2024-8176 [bsc#1239618])\n\n* Security fixes:\n  * CVE-2024-8176 -- Fix crash from chaining a large number\n    of entities caused by stack overflow by resolving use of\n    recursion, for all three uses of entities:\n    - general entities in character data (\"\u003ce\u003e\u0026g1;\u003c/e\u003e\")\n    - general entities in attribute values (\"\u003ce k1='\u0026g1;'/\u003e\")\n    - parameter entities (\"%p1;\")\n\n   Known impact is (reliable and easy) denial of service:\n\n   CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C\n\n   (Base Score: 7.5, Temporal Score: 7.2)\n\n   Please note that a layer of compression around XML can\n   significantly reduce the minimum attack payload size.\n\n   * Other changes:\n     * Document changes since the previous release\n     * Version info bumped from 11:0:10 (libexpat*.so.1.10.0)\n       to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/\n       for what these numbers do\n\nVersion update to 2.6.4:\n\n  * Security fixes: [bsc#1232601][bsc#1232579]\n    * CVE-2024-50602 -- Fix crash within function XML_ResumeParser\n      from a NULL pointer dereference by disallowing function\n      XML_StopParser to (stop or) suspend an unstarted parser.\n      A new error code XML_ERROR_NOT_STARTED was introduced to\n      properly communicate this situation.  // CWE-476 CWE-754\n  * Other changes:\n    * Version info bumped from 10:3:9 (libexpat*.so.1.9.3)\n      to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/\n      for what these numbers do\n\nUpdate to 2.6.3:\n\n  * Security fixes:\n    - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with\n      len \u003c 0 without noticing and then calling XML_GetBuffer\n      will have XML_ParseBuffer fail to recognize the problem\n      and XML_GetBuffer corrupt memory.\n      With the fix, XML_ParseBuffer now complains with error\n      XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse\n      has been doing since Expat 2.2.1, and now documented.\n      Impact is denial of service to potentially artitrary code\n      execution.\n    - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an\n      integer overflow for nDefaultAtts on 32-bit platforms\n      (where UINT_MAX equals SIZE_MAX).\n      Impact is denial of service to potentially artitrary code\n      execution.\n    - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can\n      have an integer overflow for m_groupSize on 32-bit\n      platforms (where UINT_MAX equals SIZE_MAX).\n      Impact is denial of service to potentially artitrary code\n      execution.\n\n  * Other changes:\n\n    - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)\n      to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/\n      for what these numbers do  \n\nUpdate to 2.6.2:\n\n  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated\n    use of external parsers (bsc#1221289)\n  * Reject direct parameter entity recursion and avoid the related\n    undefined behavior\n\nUpdate to 2.6.1:\n\n  * Expose billion laughs API with XML_DTD defined and XML_GE\n    undefined, regression from 2.6.0\n  * Make tests independent of CPU speed, and thus more robust\n\nUpdate to 2.6.0: \n\n  * Security fixes:\n    - CVE-2023-52425 (bsc#1219559)  \n      Fix quadratic runtime issues with big tokens\n      that can cause denial of service, in partial where\n      dealing with compressed XML input.  Applications\n      that parsed a document in one go -- a single call to\n      functions XML_Parse or XML_ParseBuffer -- were not affected.\n      The smaller the chunks/buffers you use for parsing\n      previously, the bigger the problem prior to the fix.\n      Backporters should be careful to no omit parts of\n      pull request #789 and to include earlier pull request #771,\n      in order to not break the fix.\n    - CVE-2023-52426 (bsc#1219561)\n      Fix billion laughs attacks for users\n      compiling *without* XML_DTD defined (which is not common).\n      Users with XML_DTD defined have been protected since\n      Expat \u003e=2.4.0 (and that was CVE-2013-0340 back then).\n  * Bug fixes:\n    - Fix parse-size-dependent \"invalid token\" error for\n      external entities that start with a byte order mark\n    - Fix NULL pointer dereference in setContext via\n      XML_ExternalEntityParserCreate for compilation with\n      XML_DTD undefined\n    - Protect against closing entities out of order\n  * Other changes:\n    - Improve support for arc4random/arc4random_buf\n    - Improve buffer growth in XML_GetBuffer and XML_Parse\n    - xmlwf: Support --help and --version\n    - xmlwf: Support custom buffer size for XML_GetBuffer and read\n    - xmlwf: Improve language and URL clickability in help output\n    - examples: Add new example \"element_declarations.c\"\n    - Be stricter about macro XML_CONTEXT_BYTES at build time\n    - Make inclusion to expat_config.h consistent\n    - Autotools: configure.ac: Support --disable-maintainer-mode\n    - Autotools: Sync CMake templates with CMake 3.26\n    - Autotools: Make installation of shipped man page doc/xmlwf.1\n      independent of docbook2man availability\n    - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file\n      section \"Cflags.private\" in order to fix compilation\n      against static libexpat using pkg-config on Windows\n    - Autotools|CMake: Require a C99 compiler\n      (a de-facto requirement already since Expat 2.2.2 of 2017)\n    - Autotools|CMake: Fix PACKAGE_BUGREPORT variable\n    - Autotools|CMake: Make test suite require a C++11 compiler\n    - CMake: Require CMake \u003e=3.5.0\n    - CMake: Lowercase off_t and size_t to help a bug in Meson\n    - CMake: Sort xmlwf sources alphabetically\n    - CMake|Windows: Fix generation of DLL file version info\n    - CMake: Build tests/benchmark/benchmark.c as well for\n      a build with -DEXPAT_BUILD_TESTS=ON\n    - docs: Document the importance of isFinal + adjust tests\n      accordingly\n    - docs: Improve use of \"NULL\" and \"null\"\n    - docs: Be specific about version of XML (XML 1.0r4)\n      and version of C (C99); (XML 1.0r5 will need a sponsor.)\n    - docs: reference.html: Promote function XML_ParseBuffer more\n    - docs: reference.html: Add HTML anchors to XML_* macros\n    - docs: reference.html: Upgrade to OK.css 1.2.0\n    - docs: Fix typos\n    - docs|CI: Use HTTPS URLs instead of HTTP at various places\n    - Address compiler warnings\n    - Address clang-tidy warnings\n    - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)\n      to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/\n      for what these numbers do\n","status":"published","published":"2025-04-29T11:07:45Z","modified":"2026-03-23T04:50:04.767104Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20258-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n-CVE-2024-50602: Fixed DoS via XML_ResumeParser (bsc#1232579).\n\n","status":"published","published":"2025-03-31T14:22:37Z","modified":"2026-03-23T04:50:05.655769Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20311-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\nVersion update to 2.7.1:\n\n     Bug fixes:\n\n       #980 #989  Restore event pointer behavior from Expat 2.6.4\n                    (that the fix to CVE-2024-8176 changed in 2.7.0);\n                    affected API functions are:\n                    - XML_GetCurrentByteCount\n                    - XML_GetCurrentByteIndex\n                    - XML_GetCurrentColumnNumber\n                    - XML_GetCurrentLineNumber\n                    - XML_GetInputContext\n\n     Other changes:\n\n       #976 #977  Autotools: Integrate files \"fuzz/xml_lpm_fuzzer.{cpp,proto}\"\n                    with Automake that were missing from 2.7.0 release tarballs\n       #983 #984  Fix printf format specifiers for 32bit Emscripten\n            #992  docs: Promote OpenSSF Best Practices self-certification\n            #978  tests/benchmark: Resolve mistaken double close\n            #986  Address compiler warnings\n       #990 #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)\n                    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/\n                    for what these numbers do\n\n        Infrastructure:\n\n            #982  CI: Start running Perl XML::Parser integration tests\n            #987  CI: Enforce Clang Static Analyzer clean code\n            #991  CI: Re-enable warning clang-analyzer-valist.Uninitialized\n                    for clang-tidy\n            #981  CI: Cover compilation with musl\n       #983 #984  CI: Cover compilation with 32bit Emscripten\n       #976 #977  CI: Protect against fuzzer files missing from future\n                    release archives\n\nversion update to 2.7.0 (CVE-2024-8176 [bsc#1239618]):\n\n  * Security fixes:\n\n       #893 #973  CVE-2024-8176 -- Fix crash from chaining a large number\n                    of entities caused by stack overflow by resolving use of\n                    recursion, for all three uses of entities:\n                    - general entities in character data (\"\u003ce\u003e\u0026g1;\u003c/e\u003e\")\n                    - general entities in attribute values (\"\u003ce k1='\u0026g1;'/\u003e\")\n                    - parameter entities (\"%p1;\")\n                    Known impact is (reliable and easy) denial of service:\n                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C\n                    (Base Score: 7.5, Temporal Score: 7.2)\n                    Please note that a layer of compression around XML can\n                    significantly reduce the minimum attack payload size.\n\n   * Other changes:\n       #935 #937  Autotools: Make generated CMake files look for\n                    libexpat.@SO_MAJOR@.dylib on macOS\n            #925  Autotools: Sync CMake templates with CMake 3.29\n  #945 #962 #966  CMake: Drop support for CMake \u003c3.13\n            #942  CMake: Small fuzzing related improvements\n            #921  docs: Add missing documentation of error code\n                    XML_ERROR_NOT_STARTED that was introduced with 2.6.4\n            #941  docs: Document need for C++11 compiler for use from C++\n            #959  tests/benchmark: Fix a (harmless) TOCTTOU\n            #944  Windows: Fix installer target location of file xmlwf.xml\n                    for CMake\n            #953  Windows: Address warning -Wunknown-warning-option\n                    about -Wno-pedantic-ms-format from LLVM MinGW\n            #971  Address Cppcheck warnings\n       #969 #970  Mass-migrate links from http:// to https://\n    #947 #958 ..\n       #974 #975  Document changes since the previous release\n       #974 #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)\n                    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/\n                    for what these numbers do\n\n- no source changes, just adding jira reference: jsc#SLE-21253\n\nVersion update to 2.6.4 \n\n  * Security fixes: [bsc#1232601][bsc#1232579]\n        #915  CVE-2024-50602 -- Fix crash within function XML_ResumeParser\n                from a NULL pointer dereference by disallowing function\n                XML_StopParser to (stop or) suspend an unstarted parser.\n                A new error code XML_ERROR_NOT_STARTED was introduced to\n                properly communicate this situation.  // CWE-476 CWE-754\n  * Other changes:\n        #903  CMake: Add alias target \"expat::expat\"\n        #905  docs: Document use via CMake \u003e=3.18 with FetchContent\n                and SOURCE_SUBDIR and its consequences\n        #902  tests: Reduce use of global parser instance\n        #904  tests: Resolve duplicate handler\n   #317 #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)\n        #914  Fix signedness of format strings\n   #919 #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)\n                to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/\n                for what these numbers do\n\nUpdate to 2.6.3: \n\n  * Security fixes:\n\n    - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with\n      len \u003c 0 without noticing and then calling XML_GetBuffer\n      will have XML_ParseBuffer fail to recognize the problem\n      and XML_GetBuffer corrupt memory.\n      With the fix, XML_ParseBuffer now complains with error\n      XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse\n      has been doing since Expat 2.2.1, and now documented.\n      Impact is denial of service to potentially artitrary code\n      execution.\n    - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an\n      integer overflow for nDefaultAtts on 32-bit platforms\n      (where UINT_MAX equals SIZE_MAX).\n      Impact is denial of service to potentially artitrary code\n      execution.\n    - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can\n      have an integer overflow for m_groupSize on 32-bit\n      platforms (where UINT_MAX equals SIZE_MAX).\n      Impact is denial of service to potentially artitrary code\n      execution.\n\nUpdate to 2.6.2:\n\n  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated\n    use of external parsers (bsc#1221289)\n  * Reject direct parameter entity recursion and avoid the related\n    undefined behavior\n\nUpdate to 2.6.1:\n\n  * Expose billion laughs API with XML_DTD defined and XML_GE\n    undefined, regression from 2.6.0\n  * Make tests independent of CPU speed, and thus more robust\n\nUpdate to 2.6.0: \n\n  * Security fixes:\n    - CVE-2023-52425 (bsc#1219559)  \n      -- Fix quadratic runtime issues with big tokens\n      that can cause denial of service, in partial where\n      dealing with compressed XML input.  Applications\n      that parsed a document in one go -- a single call to\n      functions XML_Parse or XML_ParseBuffer -- were not affected.\n      The smaller the chunks/buffers you use for parsing\n      previously, the bigger the problem prior to the fix.\n      Backporters should be careful to no omit parts of\n      pull request #789 and to include earlier pull request #771,\n      in order to not break the fix.\n    - CVE-2023-52426 (bsc#1219561)\n      -- Fix billion laughs attacks for users\n      compiling *without* XML_DTD defined (which is not common).\n      Users with XML_DTD defined have been protected since\n      Expat \u003e=2.4.0 (and that was CVE-2013-0340 back then).\n  * Bug fixes:\n    - Fix parse-size-dependent \"invalid token\" error for\n      external entities that start with a byte order mark\n    - Fix NULL pointer dereference in setContext via\n      XML_ExternalEntityParserCreate for compilation with\n      XML_DTD undefined\n    - Protect against closing entities out of order\n  * Other changes:\n    - Improve support for arc4random/arc4random_buf\n    - Improve buffer growth in XML_GetBuffer and XML_Parse\n    - xmlwf: Support --help and --version\n    - xmlwf: Support custom buffer size for XML_GetBuffer and read\n    - xmlwf: Improve language and URL clickability in help output\n    - examples: Add new example \"element_declarations.c\"\n    - Be stricter about macro XML_CONTEXT_BYTES at build time\n    - Make inclusion to expat_config.h consistent\n    - Autotools: configure.ac: Support --disable-maintainer-mode\n    - Autotools: Sync CMake templates with CMake 3.26\n    - Autotools: Make installation of shipped man page doc/xmlwf.1\n      independent of docbook2man availability\n    - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file\n      section \"Cflags.private\" in order to fix compilation\n      against static libexpat using pkg-config on Windows\n    - Autotools|CMake: Require a C99 compiler\n      (a de-facto requirement already since Expat 2.2.2 of 2017)\n    - Autotools|CMake: Fix PACKAGE_BUGREPORT variable\n    - Autotools|CMake: Make test suite require a C++11 compiler\n    - CMake: Require CMake \u003e=3.5.0\n    - CMake: Lowercase off_t and size_t to help a bug in Meson\n    - CMake: Sort xmlwf sources alphabetically\n    - CMake|Windows: Fix generation of DLL file version info\n    - CMake: Build tests/benchmark/benchmark.c as well for\n      a build with -DEXPAT_BUILD_TESTS=ON\n    - docs: Document the importance of isFinal + adjust tests\n      accordingly\n    - docs: Improve use of \"NULL\" and \"null\"\n    - docs: Be specific about version of XML (XML 1.0r4)\n      and version of C (C99); (XML 1.0r5 will need a sponsor.)\n    - docs: reference.html: Promote function XML_ParseBuffer more\n    - docs: reference.html: Add HTML anchors to XML_* macros\n    - docs: reference.html: Upgrade to OK.css 1.2.0\n    - docs: Fix typos\n    - docs|CI: Use HTTPS URLs instead of HTTP at various places\n    - Address compiler warnings\n    - Address clang-tidy warnings\n    - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)\n      to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/\n      for what these numbers do\n","status":"published","published":"2025-05-13T13:37:27Z","modified":"2026-03-23T04:50:06.711026Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:4512-1","title":"Security update for mozjs52","description":"This update for mozjs52 fixes the following issues:\n\n- CVE-2024-45491: Fixed integer overflow in dtdCopy (bsc#1230037)\n- CVE-2024-50602: Fixed DoS via XML_ResumeParser (bsc#1232599)\n- CVE-2024-45492: Fixed integer overflow in function nextScaffoldPart (bsc#1230038)\n- CVE-2024-45490: Fixed negative len for XML_ParseBuffer (bsc#1230036)\n","status":"published","published":"2025-12-23T12:23:19Z","modified":"2026-03-23T04:51:49.879147Z","updated_at":"2026-11-02T15:54:00.846737Z"}]},"sources_more":{"osv":2}}