In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade expatUpgrade expat-devel | May 4, 2022 | Sep 4, 2019 |
| Alpine Linux | — | Upgrade firefoxUpgrade python2-tkinterUpgrade expatUpgrade python2Upgrade firefox-esrUpgrade librewolf | Nov 8, 2019 | Sep 4, 2019 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade expat-develUpgrade expatUpgrade thunderbird-debuginfoUpgrade expat-debuginfoUpgrade expat-static | Apr 27, 2020 | Sep 4, 2019 |
| Amazon_linux | — | Upgrade expat | Dec 19, 2020 | Sep 4, 2019 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Dec 12, 2019 | Sep 4, 2019 |
| Apple Osx Libexpat | — | Apply Apple macOS Security Update 2019-002 MojaveApply Apple macOS Security Update 2019-007 High Sierra | Dec 11, 2019 | Dec 10, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 4, 2019 |
| Centos_linux | — | Upgrade expat-develUpgrade thunderbird-debuginfoUpgrade firefox-debuginfoUpgrade expat-staticUpgrade thunderbird-debugsourceUpgrade firefoxUpgrade expatUpgrade expat-debuginfoUpgrade expat-debugsourceUpgrade thunderbirdUpgrade firefox-debugsource | Oct 30, 2019 | Sep 4, 2019 |
| Debian | — | Upgrade thunderbirdUpgrade expatUpgrade firefox-esr | Sep 9, 2019 | Sep 4, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 3, 2022 |
| Freebsd | — | Upgrade python37 | Oct 20, 2019 | Oct 19, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/expat. | Nov 25, 2019 | Sep 4, 2019 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Sep 9, 2022 | Oct 22, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade expatUpgrade expat-devel | Dec 4, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade expatUpgrade expat-devel | Nov 19, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade expat-develUpgrade expat | Nov 19, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade expatUpgrade expat-devel | Nov 19, 2019 | Sep 4, 2019 |
| Mfsa2019 33 | — | Upgrade to Mozilla Firefox ESR version 68.2Upgrade to the latest version of Mozilla Firefox | Oct 23, 2019 | Sep 4, 2019 |
| Mfsa2019 34 | — | Upgrade to Mozilla Firefox version 70.0Upgrade to the latest version of Mozilla Firefox | Oct 23, 2019 | Sep 4, 2019 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 68.2 | Oct 25, 2019 | Sep 4, 2019 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle Solaris | — | Upgrade web/data/firefox-bookmarks to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade library/python/tkinter-27 to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade library/expat to version 2.2.9-11.4.16.0.1.1.0 on Solaris 11.4Upgrade runtime/python-27 to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade mail/thunderbird to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade web/browser/firefox to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade runtime/python-27/tests to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4 | Nov 20, 2019 | Sep 4, 2019 |
| Oracle_linux | — | Upgrade expat-develUpgrade thunderbirdUpgrade expat-staticUpgrade expat | Oct 30, 2019 | Sep 4, 2019 |
| Redhat_linux | — | Upgrade firefox-debuginfoUpgrade firefox-debugsourceUpgrade expat-develNo solution existsUpgrade expat-debuginfoUpgrade thunderbird-debuginfoUpgrade thunderbird-debugsourceUpgrade firefoxUpgrade thunderbirdUpgrade expat-staticUpgrade expat-debugsourceUpgrade expat | Oct 30, 2019 | Sep 4, 2019 |
| Rocky_linux | — | Upgrade expat-debugsourceUpgrade expatUpgrade expat-develUpgrade expat-debuginfo | Mar 12, 2024 | Sep 4, 2019 |
| Suse | — | Upgrade expatUpgrade mozilla-nsprUpgrade firefox-libcairo-gobject2Upgrade libpython3_6m1_0Upgrade firefox-libffi4Upgrade firefox-gtk3-dataUpgrade libfreebl3Upgrade firefox-glib2-toolsUpgrade mozilla-nss-certsUpgrade mozilla-nss-32bitUpgrade firefox-gio-branding-upstreamUpgrade python3-develUpgrade libfirefox-gobject-2_0-0Upgrade libre2-0-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libfirefox-glib-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gdk-pixbuf-langUpgrade re2-develUpgrade libfreebl3-32bitUpgrade libpython3_6m1_0-32bitUpgrade python3-32bitUpgrade MozillaFirefox-branding-SLEDUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade mozillafirefox-branding-upstreamUpgrade mozillafirefox-buildsymbolsUpgrade chromedriverUpgrade python3-idleUpgrade firefox-libffi7Upgrade libexpat-develUpgrade python3-baseUpgrade MozillaThunderbird-translations-commonUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-atk-langUpgrade libre2-0-64bitUpgrade mozilla-nss-certs-32bitUpgrade MozillaFirefoxUpgrade libsoftokn3-32bitUpgrade mozillafirefox-branding-sleUpgrade libfirefox-gio-2_0-0Upgrade MozillaFirefox-develUpgrade python3-toolsUpgrade python36Upgrade firefox-libatk-1_0-0Upgrade mozilla-nspr-32bitUpgrade firefox-esr-branding-openSUSEUpgrade libexpat-devel-32bitUpgrade firefox-gtk3-langUpgrade firefox-gtk3-immodule-ximUpgrade libexpat1Upgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-amharicUpgrade python3-testsuiteUpgrade MozillaFirefox-translations-commonUpgrade mozilla-nss-develUpgrade firefox-libcairo2Upgrade libexpat1-32bitUpgrade python3Upgrade MozillaFirefox-branding-openSUSEUpgrade libre2-0Upgrade libfirefox-gthread-2_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade python3-cursesUpgrade chromiumUpgrade libsoftokn3Upgrade firefox-gtk3-toolsUpgrade python3-tkUpgrade mozilla-nspr-develUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-multipressUpgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-immodules-tigrignaUpgrade python36-baseUpgrade python3-base-32bitUpgrade firefox-gtk3-immodule-vietnameseUpgrade MozillaThunderbird-translations-otherUpgrade MozillaThunderbirdUpgrade firefox-glib2-langUpgrade firefox-libharfbuzz0Upgrade mozilla-nssUpgrade python3-dbm | Sep 24, 2019 | Sep 4, 2019 |
| Ubuntu | — | Upgrade libvtk5.10 (Ubuntu Pro)Upgrade firefoxUpgrade libexpat1 (Ubuntu Pro)Upgrade libvtk5.8 (Ubuntu Pro)Upgrade lib64expat1 (Ubuntu Pro)Upgrade libxmltok1t64 (Ubuntu Pro)Upgrade libexpat1Upgrade lib64expat1Upgrade libxmltok1 (Ubuntu Pro)Upgrade libxmltok1t64Upgrade thunderbird | Sep 13, 2019 | Sep 4, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 4, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub