In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade expatUpgrade expat-devel | May 4, 2022 | Sep 4, 2019 |
| Alpine Linux | — | Upgrade librewolfUpgrade python2Upgrade firefox-esrUpgrade expatUpgrade firefoxUpgrade python2-tkinter | Nov 8, 2019 | Sep 4, 2019 |
| Amazon Linux Ami 2 | — | Upgrade expat-debuginfoUpgrade thunderbird-debuginfoUpgrade expat-staticUpgrade expatUpgrade expat-develUpgrade thunderbird | Apr 27, 2020 | Sep 4, 2019 |
| Amazon_linux | — | Upgrade expat | Dec 19, 2020 | Sep 4, 2019 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Dec 12, 2019 | Sep 4, 2019 |
| Apple Osx Libexpat | — | Upgrade macOS to the latest versionApply OS X security update 2019-002 MojaveApply OS X security update 2019-007 High Sierra | Dec 11, 2019 | Sep 4, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 4, 2019 |
| Centos_linux | — | Upgrade firefox-debugsourceUpgrade firefoxUpgrade thunderbirdUpgrade expatUpgrade thunderbird-debugsourceUpgrade expat-debugsourceUpgrade expat-debuginfoUpgrade expat-develUpgrade firefox-debuginfoUpgrade expat-staticUpgrade thunderbird-debuginfo | Oct 30, 2019 | Sep 4, 2019 |
| Debian | — | Upgrade thunderbirdUpgrade expatUpgrade firefox-esr | Sep 9, 2019 | Sep 4, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 3, 2022 |
| Freebsd | — | Upgrade python37 | Oct 20, 2019 | Oct 19, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/expat. | Nov 25, 2019 | Sep 4, 2019 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Sep 9, 2022 | Oct 22, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade expatUpgrade expat-devel | Dec 4, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade expat-develUpgrade expat | Nov 19, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade expatUpgrade expat-devel | Nov 19, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade expat-develUpgrade expat | Nov 19, 2019 | Sep 4, 2019 |
| Mfsa2019 33 | — | Upgrade to Mozilla Firefox ESR version 68.2 | Oct 23, 2019 | Sep 4, 2019 |
| Mfsa2019 34 | — | Upgrade to Mozilla Firefox version 70.0 | Oct 23, 2019 | Sep 4, 2019 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 68.2 | Oct 25, 2019 | Sep 4, 2019 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle Solaris | — | Upgrade runtime/python-27/tests to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade web/browser/firefox to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade library/python/tkinter-27 to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade mail/thunderbird to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade runtime/python-27 to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade library/expat to version 2.2.9-11.4.16.0.1.1.0 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4 | Nov 20, 2019 | Sep 4, 2019 |
| Oracle_linux | — | Upgrade expat-develUpgrade thunderbirdUpgrade expat-staticUpgrade expat | Oct 30, 2019 | Sep 4, 2019 |
| Redhat_linux | — | Upgrade firefoxUpgrade expat-staticUpgrade expatUpgrade expat-debugsourceUpgrade thunderbirdUpgrade thunderbird-debugsourceUpgrade expat-develUpgrade firefox-debugsourceUpgrade firefox-debuginfoUpgrade expat-debuginfoNo solution existsUpgrade thunderbird-debuginfo | Oct 30, 2019 | Sep 4, 2019 |
| Rocky_linux | — | Upgrade expat-debugsourceUpgrade expatUpgrade expat-debuginfoUpgrade expat-devel | Mar 12, 2024 | Sep 4, 2019 |
| Suse | — | Upgrade mozillafirefox-translations-otherUpgrade libre2-0Upgrade firefox-glib2-langUpgrade firefox-gtk3-immodule-amharicUpgrade python3-testsuiteUpgrade MozillaFirefox-branding-openSUSEUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nss-develUpgrade mozillafirefox-translations-commonUpgrade mozilla-nssUpgrade firefox-libharfbuzz0Upgrade python3-dbmUpgrade mozillathunderbird-translations-commonUpgrade libfirefox-gthread-2_0-0Upgrade python3Upgrade firefox-libcairo2Upgrade mozilla-nspr-develUpgrade libexpat1-32bitUpgrade python3-cursesUpgrade mozillafirefox-develUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-multipressUpgrade python3-tkUpgrade firefox-gtk3-toolsUpgrade libexpat1Upgrade libsoftokn3Upgrade python36Upgrade firefox-gtk3-immodules-tigrignaUpgrade chromiumUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-langUpgrade python36-baseUpgrade libexpat-devel-32bitUpgrade python3-base-32bitUpgrade firefox-libatk-1_0-0Upgrade mozilla-nspr-32bitUpgrade firefox-esr-branding-openSUSEUpgrade python3-toolsUpgrade expatUpgrade libsoftokn3-32bitUpgrade firefox-libcairo-gobject2Upgrade firefox-libffi7Upgrade mozilla-nss-32bitUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-glib2-toolsUpgrade mozilla-nsprUpgrade firefox-libpango-1_0-0Upgrade mozillathunderbird-translations-otherUpgrade python3-develUpgrade libpython3_6m1_0Upgrade libre2-0-32bitUpgrade firefox-atk-langUpgrade python3-32bitUpgrade mozillafirefox-branding-sledUpgrade python3-idleUpgrade libpython3_6m1_0-32bitUpgrade libfreebl3Upgrade mozilla-nss-certsUpgrade mozilla-nss-certs-32bitUpgrade re2-develUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozillathunderbirdUpgrade mozillafirefoxUpgrade libfirefox-gobject-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-gio-branding-upstreamUpgrade firefox-libffi4Upgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gdk-pixbuf-langUpgrade libfirefox-gio-2_0-0Upgrade python3-baseUpgrade chromedriverUpgrade libfirefox-glib-2_0-0Upgrade libfreebl3-32bitUpgrade libre2-0-64bitUpgrade mozillafirefox-branding-sleUpgrade firefox-gtk3-immodule-thaiUpgrade mozillafirefox-branding-upstreamUpgrade libexpat-develUpgrade mozillafirefox-buildsymbolsUpgrade firefox-gtk3-branding-upstream | Sep 24, 2019 | Sep 4, 2019 |
| Ubuntu | — | Upgrade lib64expat1Upgrade libxmltok1t64Upgrade thunderbirdUpgrade libxmltok1t64 (Ubuntu Pro)Upgrade lib64expat1 (Ubuntu Pro)Upgrade libexpat1Upgrade libxmltok1 (Ubuntu Pro)Upgrade firefoxUpgrade libvtk5.8 (Ubuntu Pro)Upgrade libvtk5.10 (Ubuntu Pro)Upgrade libexpat1 (Ubuntu Pro) | Sep 13, 2019 | Sep 4, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 4, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub