OESA-2025-2456 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat in Expat before version 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document...

OESA-2025-2455 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat in Expat before version 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document...

OESA-2025-2454 expat security update

expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial. Security Fixes: libexpat in Expat before version 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document...

JLSEC-2025-65 An issue was discovered in libexpat before 2.6.4

An issue was discovered in libexpat before 2.6.4. There is a crash within the XMLResumeParser function because XMLStopParser can stop/suspend an unstarted parser...

Security update for expat

This update for expat fixes the following issues: CVE-2025-59375: memory amplification vulnerability allows attackers to trigger excessive dynamic memory allocations by submitting crafted XML input bsc1249584. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

SUSE-SU-2025:03624-1 Security update for expat

This update for expat fixes the following issues: - CVE-2025-59375: memory amplification vulnerability allows attackers to trigger excessive dynamic memory allocations by submitting crafted XML input bsc1249584...

The vulnerability of the libexpat library for analyzing XML files, related to unlimited resource distribution, allows attackers to cause service failures.

The vulnerability of the libexpat library for analyzing XML files is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

JLSEC-2025-46 defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

defineAttribute in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...

JLSEC-2025-41 In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to...

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber then resulted in a heap-based buffer over-read...

JLSEC-2025-45 `build_model` in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

buildmodel in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...

JLSEC-2025-43 In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for...

In doProlog in xmlparse.c in Expat aka libexpat before 2.4.3, an integer overflow exists for mgroupSize...

JLSEC-2025-47 lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

lookup in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...

JLSEC-2025-53 xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator...

xmlparse.c in Expat aka libexpat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs...

JLSEC-2025-54 In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in `build_model` via...

In Expat aka libexpat before 2.4.5, an attacker can trigger stack exhaustion in buildmodel via a large nesting depth in the DTD element...

JLSEC-2025-48 nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

nextScaffoldPart in xmlparse.c in Expat aka libexpat before 2.4.3 has an integer overflow...

JLSEC-2025-57 libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c...

JLSEC-2025-55 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

In Expat aka libexpat before 2.4.5, there is an integer overflow in copyString...

JLSEC-2025-56 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

In Expat aka libexpat before 2.4.5, there is an integer overflow in storeRawNames...

JLSEC-2025-51 Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Expat aka libexpat before 2.4.4 has an integer overflow in the doProlog function...

JLSEC-2025-50 Expat (aka libexpat) before 2.4.4 has a signed integer overflow in `XML_GetBuffer`, for...

Expat aka libexpat before 2.4.4 has a signed integer overflow in XMLGetBuffer, for configurations with a nonzero XMLCONTEXTBYTES...