Red Hat Security Advisory: expat security update

Fixed packages 1

Vulnerabilities 4

• High 7.5
  CVE-2023-52425

  libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in t…

  insighttoolkit4 expat matanza vtk Debian Ubuntu Azure Linux Alpine
  Feb 4, 2024
• High 7.5
  CVE-2024-8176 Public exploit

  Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

  A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 14, 2025
• High 7.5
  CVE-2025-59375

  libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that i…

  libexpat project libexpat thunderbird firefox-esr Debian Ubuntu Azure Linux Alpine Wolfi
  Sep 15, 2025
• Unscored —
  CVE-2013-0340 EPSS 19%

  expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_Set…

  expat libxmltok Debian
  Jan 21, 2014

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1000109
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262877
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2310137
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395108
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22035.json
• report
  https://access.redhat.com/security/cve/CVE-2013-0340
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-0340
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-0340
• report
  https://access.redhat.com/security/cve/CVE-2023-52425
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-52425
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-52425
• report
  https://access.redhat.com/security/cve/CVE-2024-8176
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-8176
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-8176
• article
  https://github.com/libexpat/libexpat/issues/893
• article
  https://github.com/libexpat/libexpat/pull/973
• report
  https://access.redhat.com/security/cve/CVE-2025-59375
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-59375
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-59375
• article
  https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2025-59375
• article
  https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2025-59375