Red Hat Security Advisory: expat security update

Fixed packages 1

Vulnerabilities 18

• Critical 9.8
  CVE-2022-22822 Public exploit

  addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Jan 8, 2022
• Critical 9.8
  CVE-2022-22823

  build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Jan 8, 2022
• Critical 9.8
  CVE-2022-22824

  defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Jan 8, 2022
• High 8.8
  CVE-2021-45960 Public exploit

  In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can l…

  firefox insighttoolkit4 expat swish-e Debian Ubuntu Azure Linux Alpine
  Jan 1, 2022
• High 8.8
  CVE-2022-22825

  lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Jan 8, 2022
• High 8.8
  CVE-2022-22826

  nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Jan 8, 2022
• High 8.8
  CVE-2022-22827

  storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Jan 8, 2022
• High 8.1
  CVE-2021-46143 Public exploit

  In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

  firefox insighttoolkit4 qtwebengine-opensource-src expat Debian Ubuntu Azure Linux Alpine
  Jan 6, 2022
• High 7.5
  CVE-2018-20843

  In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the X…

  insighttoolkit4 expat matanza vtk Debian Ubuntu Alpine
  Jun 24, 2019
• High 7.5
  CVE-2022-23990 Public exploit

  Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

  thunderbird firefox expat swish-e Debian Ubuntu Azure Linux Alpine
  Jan 26, 2022
• High 7.5
  CVE-2022-25314 Public exploit

  In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Feb 18, 2022
• High 7.5
  CVE-2022-43680 Public exploit

  In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnt…

  thunderbird insighttoolkit4 expat matanza Debian Ubuntu Azure Linux Alpine
  Oct 24, 2022
• High 7.5
  CVE-2023-52425

  libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in t…

  insighttoolkit4 expat swish-e matanza Debian Ubuntu Azure Linux Alpine
  Feb 4, 2024
• High 7.5
  CVE-2024-8176 Public exploit

  Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

  A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi
  Mar 14, 2025
• High 7.5
  CVE-2025-59375

  libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that i…

  libexpat project libexpat thunderbird firefox-esr Debian Ubuntu Azure Linux Alpine Wolfi
  Sep 15, 2025
• Medium 6.5
  CVE-2019-15903

  In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing to…

  chromium-browser thunderbird firefox thunderbird Debian Ubuntu Alpine
  Sep 4, 2019
• Medium 6.5
  CVE-2022-25313 Public exploit

  In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth…

  thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine
  Feb 18, 2022
• Unscored —
  CVE-2013-0340 EPSS 19%

  expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_Set…

  expat libxmltok Debian
  Jan 21, 2014

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1000109
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1723723
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1752592
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044451
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044455
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044457
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044464
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044467
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044479
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044484
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044488
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2048356
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2056350
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2056354
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2140059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262877
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2310137
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395108
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22871.json
• report
  https://access.redhat.com/security/cve/CVE-2013-0340
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-0340
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-0340
• report
  https://access.redhat.com/security/cve/CVE-2018-20843
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-20843
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-20843
• article
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031
• report
  https://access.redhat.com/security/cve/CVE-2019-15903
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-15903
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-15903
• report
  https://access.redhat.com/security/cve/CVE-2021-45960
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-45960
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-45960
• article
  https://github.com/libexpat/libexpat/issues/531
• report
  https://access.redhat.com/security/cve/CVE-2021-46143
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-46143
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-46143
• article
  https://github.com/libexpat/libexpat/issues/532
• report
  https://access.redhat.com/security/cve/CVE-2022-22822