Red Hat Security Advisory: expat security update

Fixed packages 4

Vulnerabilities 4

• High 7.5
  CVE-2022-23990 Public exploit

  Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

  thunderbird firefox expat matanza Debian Ubuntu Azure Linux Alpine
  Jan 26, 2022
• High 7.5
  CVE-2024-28757 Public exploit

  libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created vi…

  insighttoolkit4 expat vtk swish-e Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 10, 2024
• High 7.5
  CVE-2025-59375

  libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that i…

  libexpat project libexpat thunderbird firefox-esr Debian Ubuntu Azure Linux Alpine Wolfi
  Sep 15, 2025
• Unscored —
  CVE-2013-0340 EPSS 19%

  expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_Set…

  expat libxmltok Debian
  Jan 21, 2014

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395108
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21776.json
• report
  https://access.redhat.com/security/cve/CVE-2013-0340
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1000109
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-0340
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-0340
• report
  https://access.redhat.com/security/cve/CVE-2022-23990
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2048356
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-23990
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-23990
• report
  https://access.redhat.com/security/cve/CVE-2024-28757
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268766
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-28757
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-28757
• article
  https://github.com/libexpat/libexpat/issues/839
• report
  https://access.redhat.com/security/cve/CVE-2025-59375
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-59375
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-59375
• article
  https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2025-59375
• article
  https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2025-59375