Expat has an unspecified vulnerability

Expat is a fast streaming XML parser written in C. A security vulnerability exists in Expat, which stems from the fact that in Expat (aka libexpat) prior to 2.4.3, the storeAtts function in xmlparse.c shifted left by 29 (or more) bits may cause realloc misbehavior (e.g., allocating too few bytes too few, or only releasing memory). No detailed vulnerability details are currently available.