Critical DLA-2935-1 5 CVEs

expat - security update

Published Mar 7, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 9	expat	2.2.0-2+deb9u5

Vulnerabilities 5

Critical 9.8

CVE-2022-23852 Public exploit

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML…

thunderbird firefox qt5-qtwebengine insighttoolkit4 Debian Ubuntu Azure Linux Alpine

Jan 24, 2022
Critical 9.8

CVE-2022-25235 Public exploit

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 16, 2022
Critical 9.8

CVE-2022-25236 Public exploit EPSS 35%

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 16, 2022
Critical 9.8

CVE-2022-25315 Public exploit

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 18, 2022
Medium 6.5

CVE-2022-25313 Public exploit

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 18, 2022