In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade expatUpgrade expat-devel | May 4, 2022 | Sep 4, 2019 |
| Alpine Linux | — | Upgrade firefoxUpgrade python2-tkinterUpgrade python2Upgrade expatUpgrade firefox-esrUpgrade librewolf | Nov 8, 2019 | Sep 4, 2019 |
| Amazon Linux Ami 2 | — | Upgrade expat-staticUpgrade expatUpgrade thunderbird-debuginfoUpgrade expat-debuginfoUpgrade expat-develUpgrade thunderbird | Apr 27, 2020 | Sep 4, 2019 |
| Amazon_linux | — | Upgrade expat | Dec 19, 2020 | Sep 4, 2019 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Dec 12, 2019 | Dec 11, 2019 |
| Apple Osx Libexpat | — | Apply Apple macOS Security Update 2019-007 High SierraApply Apple macOS Security Update 2019-002 Mojave | Dec 11, 2019 | Dec 10, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 4, 2019 |
| Centos_linux | — | Upgrade firefox-debuginfoUpgrade expat-staticUpgrade expat-develUpgrade thunderbird-debuginfoUpgrade expatUpgrade expat-debuginfoUpgrade thunderbird-debugsourceUpgrade firefox-debugsourceUpgrade expat-debugsourceUpgrade thunderbirdUpgrade firefox | Oct 30, 2019 | Sep 4, 2019 |
| Debian | — | Upgrade thunderbirdUpgrade expatUpgrade firefox-esr | Sep 9, 2019 | Sep 4, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 3, 2022 |
| Freebsd | — | Upgrade python37 | Oct 20, 2019 | Oct 19, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/expat. | Nov 25, 2019 | Sep 4, 2019 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Sep 9, 2022 | Oct 22, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade expat-develUpgrade expat | Dec 4, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade expat-develUpgrade expat | Nov 19, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade expatUpgrade expat-devel | Nov 19, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade expatUpgrade expat-devel | Nov 19, 2019 | Sep 4, 2019 |
| Mfsa2019 33 | — | Upgrade to Mozilla Firefox ESR version 68.2Upgrade to the latest version of Mozilla Firefox | Oct 23, 2019 | Sep 4, 2019 |
| Mfsa2019 34 | — | Upgrade to Mozilla Firefox version 70.0Upgrade to the latest version of Mozilla Firefox | Oct 23, 2019 | Sep 4, 2019 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 68.2Upgrade to the latest version of Mozilla Thunderbird | Oct 25, 2019 | Sep 4, 2019 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle Solaris | — | Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade web/browser/firefox to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade runtime/python-27/tests to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade mail/thunderbird to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade library/expat to version 2.2.9-11.4.16.0.1.1.0 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade library/python/tkinter-27 to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade runtime/python-27 to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4 | Nov 20, 2019 | Sep 4, 2019 |
| Oracle_linux | — | Upgrade expat-staticUpgrade expatUpgrade expat-develUpgrade thunderbird | Oct 30, 2019 | Sep 4, 2019 |
| Redhat_linux | — | Upgrade thunderbird-debuginfoUpgrade firefox-debuginfoUpgrade expat-debuginfoUpgrade expat-develNo solution existsUpgrade firefox-debugsourceUpgrade thunderbirdUpgrade firefoxUpgrade expat-debugsourceUpgrade expat-staticUpgrade thunderbird-debugsourceUpgrade expat | Oct 30, 2019 | Sep 4, 2019 |
| Rocky_linux | — | Upgrade expat-develUpgrade expat-debuginfoUpgrade expatUpgrade expat-debugsource | Mar 12, 2024 | Sep 4, 2019 |
| Suse | — | Upgrade mozilla-nssUpgrade libexpat1-32bitUpgrade python3-base-32bitUpgrade MozillaThunderbird-translations-otherUpgrade python3-tkUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nspr-develUpgrade firefox-esr-branding-openSUSEUpgrade firefox-gtk3-langUpgrade python36Upgrade firefox-gtk3-toolsUpgrade python3-toolsUpgrade firefox-libatk-1_0-0Upgrade mozilla-nspr-32bitUpgrade libexpat-devel-32bitUpgrade python36-baseUpgrade libsoftokn3Upgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nss-toolsUpgrade MozillaThunderbirdUpgrade firefox-gtk3-immodule-vietnameseUpgrade chromiumUpgrade libfirefox-gthread-2_0-0Upgrade libre2-0Upgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-ximUpgrade firefox-libcairo2Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libharfbuzz0Upgrade libexpat1Upgrade python3-cursesUpgrade firefox-glib2-langUpgrade MozillaFirefox-translations-commonUpgrade python3-dbmUpgrade firefox-gtk3-immodule-amharicUpgrade python3-testsuiteUpgrade mozilla-nss-develUpgrade MozillaFirefox-branding-openSUSEUpgrade MozillaFirefox-develUpgrade python3Upgrade firefox-glib2-toolsUpgrade firefox-gtk3-immodule-thaiUpgrade python3-32bitUpgrade firefox-libffi4Upgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-libffi7Upgrade mozillafirefox-branding-upstreamUpgrade libpython3_6m1_0Upgrade python3-baseUpgrade libfreebl3Upgrade mozilla-nss-certsUpgrade mozilla-nss-32bitUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-dataUpgrade libre2-0-64bitUpgrade python3-develUpgrade firefox-libpango-1_0-0Upgrade firefox-libcairo-gobject2Upgrade python3-idleUpgrade mozilla-nss-certs-32bitUpgrade libpython3_6m1_0-32bitUpgrade firefox-gdk-pixbuf-langUpgrade libfreebl3-32bitUpgrade libfirefox-glib-2_0-0Upgrade MozillaFirefoxUpgrade chromedriverUpgrade libfirefox-gio-2_0-0Upgrade mozillafirefox-branding-sleUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gdk-pixbuf-query-loadersUpgrade mozilla-nsprUpgrade MozillaThunderbird-translations-commonUpgrade firefox-atk-langUpgrade expatUpgrade firefox-gio-branding-upstreamUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade re2-develUpgrade libre2-0-32bitUpgrade libfirefox-gobject-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade mozillafirefox-buildsymbolsUpgrade libexpat-devel | Sep 24, 2019 | Sep 4, 2019 |
| Ubuntu | — | Upgrade firefoxUpgrade libvtk5.10 (Ubuntu Pro)Upgrade libexpat1 (Ubuntu Pro)Upgrade libvtk5.8 (Ubuntu Pro)Upgrade libxmltok1 (Ubuntu Pro)Upgrade lib64expat1Upgrade libexpat1Upgrade libxmltok1t64 (Ubuntu Pro)Upgrade thunderbirdUpgrade libxmltok1t64Upgrade lib64expat1 (Ubuntu Pro) | Sep 13, 2019 | Sep 4, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 4, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub