In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade expatUpgrade expat-devel | May 4, 2022 | Sep 4, 2019 |
| Alpine Linux | — | Upgrade python2-tkinterUpgrade firefoxUpgrade librewolfUpgrade expatUpgrade firefox-esrUpgrade python2 | Nov 8, 2019 | Sep 4, 2019 |
| Amazon Linux Ami 2 | — | Upgrade expatUpgrade expat-staticUpgrade thunderbird-debuginfoUpgrade expat-debuginfoUpgrade expat-develUpgrade thunderbird | Apr 27, 2020 | Sep 4, 2019 |
| Amazon_linux | — | Upgrade expat | Dec 19, 2020 | Sep 4, 2019 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Dec 12, 2019 | Sep 4, 2019 |
| Apple Osx Libexpat | — | Apply OS X security update 2019-007 High SierraApply OS X security update 2019-002 MojaveUpgrade macOS to the latest version | Dec 11, 2019 | Sep 4, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 4, 2019 |
| Centos_linux | — | Upgrade thunderbird-debugsourceUpgrade firefoxUpgrade firefox-debugsourceUpgrade expat-debuginfoUpgrade expat-debugsourceUpgrade expatUpgrade thunderbirdUpgrade expat-staticUpgrade expat-develUpgrade thunderbird-debuginfoUpgrade firefox-debuginfo | Oct 30, 2019 | Sep 4, 2019 |
| Debian | — | Upgrade thunderbirdUpgrade firefox-esrUpgrade expat | Sep 9, 2019 | Sep 4, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Feb 3, 2022 |
| Freebsd | — | Upgrade python37 | Oct 20, 2019 | Oct 19, 2019 |
| Gentoo Linux | — | Upgrade dev-libs/expat. | Nov 25, 2019 | Sep 4, 2019 |
| Google Chrome | — | Upgrade to the latest version of Google Chrome | Sep 9, 2022 | Oct 22, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade expatUpgrade expat-devel | Dec 4, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade expat-develUpgrade expat | Nov 19, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade expat-develUpgrade expat | Nov 19, 2019 | Sep 4, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade expat-develUpgrade expat | Nov 19, 2019 | Sep 4, 2019 |
| Mfsa2019 33 | — | Upgrade to Mozilla Firefox ESR version 68.2 | Oct 23, 2019 | Sep 4, 2019 |
| Mfsa2019 34 | — | Upgrade to Mozilla Firefox version 70.0 | Oct 23, 2019 | Sep 4, 2019 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 68.2 | Oct 25, 2019 | Sep 4, 2019 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle Solaris | — | Upgrade library/expat to version 2.2.9-11.4.16.0.1.1.0 on Solaris 11.4Upgrade runtime/python-27 to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade library/python/tkinter-27 to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade mail/thunderbird to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade runtime/python-27/tests to version 2.7.17-11.4.16.0.1.2.0 on Solaris 11.4Upgrade web/browser/firefox to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4 | Nov 20, 2019 | Sep 4, 2019 |
| Oracle_linux | — | Upgrade expatUpgrade expat-staticUpgrade expat-develUpgrade thunderbird | Oct 30, 2019 | Sep 4, 2019 |
| Redhat_linux | — | Upgrade expat-staticUpgrade expat-debugsourceUpgrade thunderbirdUpgrade thunderbird-debugsourceUpgrade expatUpgrade firefoxUpgrade firefox-debuginfoUpgrade expat-debuginfoNo solution existsUpgrade expat-develUpgrade firefox-debugsourceUpgrade thunderbird-debuginfo | Oct 30, 2019 | Sep 4, 2019 |
| Rocky_linux | — | Upgrade expatUpgrade expat-debugsourceUpgrade expat-debuginfoUpgrade expat-devel | Mar 12, 2024 | Sep 4, 2019 |
| Suse | — | Upgrade firefox-glib2-toolsUpgrade mozillafirefoxUpgrade mozillafirefox-branding-upstreamUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade libre2-0-64bitUpgrade mozillathunderbird-translations-otherUpgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-dataUpgrade re2-develUpgrade firefox-libffi7Upgrade libre2-0-32bitUpgrade libfreebl3-32bitUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-libffi4Upgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gdk-pixbuf-query-loadersUpgrade mozillathunderbirdUpgrade firefox-atk-langUpgrade firefox-gtk3-branding-upstreamUpgrade expatUpgrade mozilla-nsprUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gdk-pixbuf-langUpgrade libsoftokn3-32bitUpgrade libexpat-develUpgrade libfirefox-glib-2_0-0Upgrade mozillafirefox-branding-sledUpgrade libfirefox-gio-2_0-0Upgrade python3-32bitUpgrade python3-idleUpgrade mozillafirefox-branding-sleUpgrade firefox-libcairo-gobject2Upgrade mozilla-nss-32bitUpgrade mozilla-nss-certsUpgrade mozillafirefox-buildsymbolsUpgrade mozilla-nss-certs-32bitUpgrade libpython3_6m1_0-32bitUpgrade firefox-gtk3-immodule-thaiUpgrade python3-baseUpgrade python3-develUpgrade libfreebl3Upgrade firefox-libpango-1_0-0Upgrade libpython3_6m1_0Upgrade chromedriverUpgrade mozilla-nspr-develUpgrade python3-tkUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nss-develUpgrade libfirefox-gthread-2_0-0Upgrade mozillafirefox-develUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-multipressUpgrade python3-cursesUpgrade firefox-esr-branding-openSUSEUpgrade firefox-libatk-1_0-0Upgrade python3-toolsUpgrade python36Upgrade python3-testsuiteUpgrade firefox-libharfbuzz0Upgrade libexpat1-32bitUpgrade mozilla-nssUpgrade mozillafirefox-translations-commonUpgrade python3-dbmUpgrade MozillaFirefox-branding-openSUSEUpgrade firefox-gtk3-immodule-amharicUpgrade libexpat1Upgrade firefox-gtk3-langUpgrade libsoftokn3Upgrade firefox-gtk3-toolsUpgrade libexpat-devel-32bitUpgrade python3-base-32bitUpgrade chromiumUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-immodule-vietnameseUpgrade python36-baseUpgrade firefox-libgtk-3-0Upgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-ximUpgrade libre2-0Upgrade mozillathunderbird-translations-commonUpgrade python3Upgrade firefox-libcairo2Upgrade mozillafirefox-translations-otherUpgrade firefox-glib2-lang | Sep 24, 2019 | Sep 4, 2019 |
| Ubuntu | — | Upgrade libvtk5.8 (Ubuntu Pro)Upgrade libvtk5.10 (Ubuntu Pro)Upgrade libexpat1 (Ubuntu Pro)Upgrade firefoxUpgrade libxmltok1 (Ubuntu Pro)Upgrade lib64expat1Upgrade libxmltok1t64 (Ubuntu Pro)Upgrade libxmltok1t64Upgrade lib64expat1 (Ubuntu Pro)Upgrade thunderbirdUpgrade libexpat1 | Sep 13, 2019 | Sep 4, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 4, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub