In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade expat-develUpgrade expat | May 4, 2022 | Sep 4, 2019 |
| Alpine Linux | — | Upgrade expatUpgrade firefox-esrUpgrade librewolfUpgrade python2Upgrade firefoxUpgrade python2-tkinter | Nov 8, 2019 | Sep 4, 2019 |
| Amazon Linux Ami 2 | — | Upgrade expat-staticUpgrade thunderbird-debuginfoUpgrade expat-debuginfoUpgrade expatUpgrade expat-develUpgrade thunderbird | Apr 27, 2020 | Sep 4, 2019 |
| Amazon_linux | — | Upgrade expat | Dec 19, 2020 | Sep 4, 2019 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Dec 12, 2019 | Dec 11, 2019 |
| Apple Osx Libexpat | — | Apply Apple macOS Security Update 2019-007 High SierraApply Apple macOS Security Update 2019-002 Mojave | Dec 11, 2019 | Dec 10, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 4, 2019 |
| Centos_linux | — | Upgrade expat-develUpgrade thunderbird-debuginfoUpgrade expat-staticUpgrade firefox-debuginfoUpgrade expatUpgrade firefox-debugsourceUpgrade firefoxUpgrade expat-debuginfoUpgrade thunderbirdUpgrade expat-debugsourceUpgrade thunderbird-debugsource | Oct 30, 2019 | Sep 4, 2019 |
| Debian | — | Upgrade firefox-esrUpgrade expatUpgrade thunderbird | Sep 9, 2019 | Sep 4, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 3, 2022 |
| Freebsd | — | Upgrade python37 | Oct 20, 2019 | Oct 19, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/expat. | Nov 25, 2019 | Sep 4, 2019 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Sep 9, 2022 | Oct 22, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade expat-develUpgrade expat | Dec 4, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade expat-develUpgrade expat | Nov 19, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade expatUpgrade expat-devel | Nov 19, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade expat-develUpgrade expat | Nov 19, 2019 | Sep 4, 2019 |
| Mfsa2019 33 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 68.2 | Oct 23, 2019 | Sep 4, 2019 |
| Mfsa2019 34 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 70.0 | Oct 23, 2019 | Sep 4, 2019 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 68.2 | Oct 25, 2019 | Sep 4, 2019 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle Solaris | — | Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade web/browser/firefox to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade runtime/python-27/tests to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade runtime/python-27 to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade library/expat to version 2.2.9-11.4.16.0.1.1.0 on Solaris 11.4Upgrade library/python/tkinter-27 to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade mail/thunderbird to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4 | Nov 20, 2019 | Sep 4, 2019 |
| Oracle_linux | — | Upgrade thunderbirdUpgrade expat-develUpgrade expatUpgrade expat-static | Oct 30, 2019 | Sep 4, 2019 |
| Redhat_linux | — | Upgrade thunderbird-debuginfoUpgrade firefox-debugsourceUpgrade firefox-debuginfoUpgrade expat-develNo solution existsUpgrade expat-debuginfoUpgrade firefoxUpgrade thunderbirdUpgrade expatUpgrade expat-debugsourceUpgrade thunderbird-debugsourceUpgrade expat-static | Oct 30, 2019 | Sep 4, 2019 |
| Rocky_linux | — | Upgrade expat-debugsourceUpgrade expatUpgrade expat-debuginfoUpgrade expat-devel | Mar 12, 2024 | Sep 4, 2019 |
| Suse | — | Upgrade firefox-libharfbuzz0Upgrade libfirefox-gthread-2_0-0Upgrade firefox-esr-branding-openSUSEUpgrade firefox-libatk-1_0-0Upgrade mozilla-nspr-32bitUpgrade python3-dbmUpgrade firefox-libgtk-3-0Upgrade python36Upgrade python3-toolsUpgrade libexpat1-32bitUpgrade python3-base-32bitUpgrade mozilla-nssUpgrade firefox-gtk3-immodule-ximUpgrade firefox-libcairo2Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-glib2-langUpgrade MozillaFirefox-branding-openSUSEUpgrade MozillaFirefox-translations-commonUpgrade firefox-gtk3-immodule-amharicUpgrade libsoftokn3Upgrade mozilla-nss-develUpgrade MozillaFirefox-develUpgrade libexpat1Upgrade firefox-gtk3-langUpgrade firefox-gtk3-toolsUpgrade python36-baseUpgrade libexpat-devel-32bitUpgrade python3-cursesUpgrade MozillaThunderbirdUpgrade python3-tkUpgrade python3-testsuiteUpgrade python3Upgrade mozilla-nspr-develUpgrade MozillaThunderbird-translations-otherUpgrade mozilla-nss-toolsUpgrade libre2-0Upgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-immodule-vietnameseUpgrade chromiumUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gio-branding-upstreamUpgrade chromedriverUpgrade libexpat-develUpgrade mozillafirefox-branding-upstreamUpgrade mozilla-nss-32bitUpgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nsprUpgrade libpython3_6m1_0Upgrade python3-baseUpgrade firefox-libpango-1_0-0Upgrade firefox-atk-langUpgrade firefox-libffi4Upgrade libfreebl3Upgrade mozillafirefox-branding-sleUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-glib2-toolsUpgrade expatUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade libsoftokn3-32bitUpgrade libpython3_6m1_0-32bitUpgrade MozillaFirefoxUpgrade firefox-gdk-pixbuf-langUpgrade libfirefox-glib-2_0-0Upgrade libfreebl3-32bitUpgrade libfirefox-gio-2_0-0Upgrade python3-32bitUpgrade libfirefox-gobject-2_0-0Upgrade re2-develUpgrade libre2-0-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-dataUpgrade python3-idleUpgrade libre2-0-64bitUpgrade firefox-libffi7Upgrade firefox-gtk3-immodule-thaiUpgrade mozillafirefox-buildsymbolsUpgrade python3-develUpgrade mozilla-nss-certsUpgrade firefox-libcairo-gobject2Upgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gdk-pixbuf-query-loadersUpgrade MozillaThunderbird-translations-common | Sep 24, 2019 | Sep 4, 2019 |
| Ubuntu | — | Upgrade thunderbirdUpgrade lib64expat1Upgrade libexpat1Upgrade libxmltok1t64 (Ubuntu Pro)Upgrade libxmltok1 (Ubuntu Pro)Upgrade lib64expat1 (Ubuntu Pro)Upgrade libxmltok1t64Upgrade libexpat1 (Ubuntu Pro)Upgrade libvtk5.8 (Ubuntu Pro)Upgrade libvtk5.10 (Ubuntu Pro)Upgrade firefox | Sep 13, 2019 | Sep 4, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 4, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub