In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade expatUpgrade expat-devel | May 4, 2022 | Sep 4, 2019 |
| Alpine Linux | — | Upgrade firefoxUpgrade python2-tkinterUpgrade python2Upgrade firefox-esrUpgrade librewolfUpgrade expat | Nov 8, 2019 | Sep 4, 2019 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade expat-develUpgrade expatUpgrade thunderbird-debuginfoUpgrade expat-staticUpgrade expat-debuginfo | Apr 27, 2020 | Sep 4, 2019 |
| Amazon_linux | — | Upgrade expat | Dec 19, 2020 | Sep 4, 2019 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Dec 12, 2019 | Dec 11, 2019 |
| Apple Osx Libexpat | — | Apply Apple macOS Security Update 2019-002 MojaveApply Apple macOS Security Update 2019-007 High Sierra | Dec 11, 2019 | Dec 10, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 4, 2019 |
| Centos_linux | — | Upgrade firefox-debuginfoUpgrade expat-develUpgrade thunderbird-debuginfoUpgrade expat-staticUpgrade firefoxUpgrade expatUpgrade expat-debuginfoUpgrade thunderbirdUpgrade expat-debugsourceUpgrade firefox-debugsourceUpgrade thunderbird-debugsource | Oct 30, 2019 | Sep 4, 2019 |
| Debian | — | Upgrade expatUpgrade firefox-esrUpgrade thunderbird | Sep 9, 2019 | Sep 4, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 3, 2022 |
| Freebsd | — | Upgrade python37 | Oct 20, 2019 | Oct 19, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/expat. | Nov 25, 2019 | Sep 4, 2019 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Sep 9, 2022 | Oct 22, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade expat-develUpgrade expat | Dec 4, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade expat-develUpgrade expat | Nov 19, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade expat-develUpgrade expat | Nov 19, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade expatUpgrade expat-devel | Nov 19, 2019 | Sep 4, 2019 |
| Mfsa2019 33 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 68.2 | Oct 23, 2019 | Sep 4, 2019 |
| Mfsa2019 34 | — | Upgrade to Mozilla Firefox version 70.0Upgrade to the latest version of Mozilla Firefox | Oct 23, 2019 | Sep 4, 2019 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 68.2Upgrade to the latest version of Mozilla Thunderbird | Oct 25, 2019 | Sep 4, 2019 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle Solaris | — | Upgrade library/expat to version 2.2.9-11.4.16.0.1.1.0 on Solaris 11.4Upgrade library/python/tkinter-27 to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade mail/thunderbird to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade runtime/python-27 to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade runtime/python-27/tests to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade web/browser/firefox to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4 | Nov 20, 2019 | Sep 4, 2019 |
| Oracle_linux | — | Upgrade expat-staticUpgrade expatUpgrade thunderbirdUpgrade expat-devel | Oct 30, 2019 | Sep 4, 2019 |
| Redhat_linux | — | Upgrade firefoxUpgrade thunderbirdUpgrade expat-staticUpgrade expat-debugsourceUpgrade expatUpgrade thunderbird-debugsourceUpgrade expat-develUpgrade thunderbird-debuginfoUpgrade firefox-debuginfoUpgrade expat-debuginfoUpgrade firefox-debugsourceNo solution exists | Oct 30, 2019 | Sep 4, 2019 |
| Rocky_linux | — | Upgrade expat-debuginfoUpgrade expat-develUpgrade expat-debugsourceUpgrade expat | Mar 12, 2024 | Sep 4, 2019 |
| Suse | — | Upgrade firefox-glib2-toolsUpgrade firefox-gtk3-dataUpgrade libsoftokn3-32bitUpgrade firefox-libffi4Upgrade MozillaFirefoxUpgrade python3-32bitUpgrade python3-idleUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gdk-pixbuf-langUpgrade python3-develUpgrade mozilla-nss-certsUpgrade firefox-libcairo-gobject2Upgrade libfreebl3Upgrade mozillafirefox-buildsymbolsUpgrade mozilla-nss-32bitUpgrade mozillafirefox-branding-upstreamUpgrade mozillafirefox-branding-sleUpgrade firefox-libpango-1_0-0Upgrade mozilla-nss-certs-32bitUpgrade firefox-libffi7Upgrade libre2-0-32bitUpgrade firefox-atk-langUpgrade re2-develUpgrade libfirefox-glib-2_0-0Upgrade libre2-0-64bitUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade libpython3_6m1_0-32bitUpgrade libexpat-develUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gio-branding-upstreamUpgrade MozillaThunderbird-translations-commonUpgrade MozillaFirefox-branding-SLEDUpgrade python3-baseUpgrade chromedriverUpgrade libpython3_6m1_0Upgrade libfirefox-gobject-2_0-0Upgrade expatUpgrade firefox-gdk-pixbuf-query-loadersUpgrade mozilla-nsprUpgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade libfreebl3-32bitUpgrade firefox-libgtk-3-0Upgrade python3-cursesUpgrade MozillaFirefox-develUpgrade MozillaThunderbird-translations-otherUpgrade mozilla-nspr-develUpgrade MozillaThunderbirdUpgrade mozilla-nss-toolsUpgrade libfirefox-gthread-2_0-0Upgrade firefox-libcairo2Upgrade firefox-gtk3-immodule-ximUpgrade libre2-0Upgrade python3Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libharfbuzz0Upgrade chromiumUpgrade python3-dbmUpgrade python36-baseUpgrade mozilla-nssUpgrade firefox-esr-branding-openSUSEUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-glib2-langUpgrade python3-tkUpgrade python36Upgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodules-tigrignaUpgrade libexpat-devel-32bitUpgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-langUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-multipressUpgrade MozillaFirefox-translations-commonUpgrade firefox-libatk-1_0-0Upgrade python3-testsuiteUpgrade MozillaFirefox-branding-openSUSEUpgrade python3-toolsUpgrade libexpat1Upgrade mozilla-nss-develUpgrade libexpat1-32bitUpgrade libsoftokn3Upgrade python3-base-32bitUpgrade firefox-gtk3-tools | Sep 24, 2019 | Sep 4, 2019 |
| Ubuntu | — | Upgrade libxmltok1t64Upgrade thunderbirdUpgrade libxmltok1 (Ubuntu Pro)Upgrade libexpat1Upgrade lib64expat1 (Ubuntu Pro)Upgrade lib64expat1Upgrade libxmltok1t64 (Ubuntu Pro)Upgrade libvtk5.10 (Ubuntu Pro)Upgrade libvtk5.8 (Ubuntu Pro)Upgrade firefoxUpgrade libexpat1 (Ubuntu Pro) | Sep 13, 2019 | Sep 4, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 4, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub