Every applicability statement published about this vulnerability, kept as each source wrote it rather than merged into one verdict. Where sources disagree, both positions are shown.
A statement that names no version covers the whole product, which is not the same as your version falling inside a range. Orderings marked best effort come from schemes with no published comparison algorithm; exact ones follow a published specification.
Precedence decides which claim wins when two sources describe the same product over the same version range. It is a property of the source, not of the claim, and changing it re-ranks the data without re-reading a single document.
| Product | Status | Versions | Remediation | Source | |
|---|---|---|---|---|---|
| red_hat_enterprise_linux_6:expat expat as a component of Red Hat Enterprise Linux 6 | affected | no version stated vendor label: expat | out of support | csaf_redhat | |
| red_hat_enterprise_linux_7:expat expat as a component of Red Hat Enterprise Linux 7 | affected | no version stated vendor label: expat | out of support | csaf_redhat | |
| red_hat_enterprise_linux_6:expat-devel expat-devel as a component of Red Hat Enterprise Linux 6 | affected | no version stated vendor label: expat-devel | out of support | csaf_redhat | |
| red_hat_enterprise_linux_7:expat-devel expat-devel as a component of Red Hat Enterprise Linux 7 | affected | no version stated vendor label: expat-devel | out of support | csaf_redhat | |
| red_hat_enterprise_linux_7:expat-static expat-static as a component of Red Hat Enterprise Linux 7 | affected | no version stated vendor label: expat-static | out of support | csaf_redhat | |
| red_hat_enterprise_linux_6:expat.src expat.src as a component of Red Hat Enterprise Linux 6 | affected | no version stated vendor label: expat.src | out of support | csaf_redhat | |
| red_hat_enterprise_linux_7:expat.src expat.src as a component of Red Hat Enterprise Linux 7 | affected | no version stated vendor label: expat.src | out of support | csaf_redhat | |
| red_hat_enterprise_linux_8:firefox::firefox:flatpak firefox (firefox:flatpak) as a component of Red Hat Enterprise Linux 8 | affected | no version stated vendor label: firefox::firefox:flatpak | no fix planned | csaf_redhat | |
| red_hat_enterprise_linux_7:firefox firefox as a component of Red Hat Enterprise Linux 7 | affected | no version stated vendor label: firefox | out of support | csaf_redhat | |
| red_hat_enterprise_linux_8:firefox.src::firefox:flatpak firefox.src (firefox:flatpak) as a component of Red Hat Enterprise Linux 8 | affected | no version stated vendor label: firefox.src::firefox:flatpak | no fix planned | csaf_redhat | |
| red_hat_enterprise_linux_7:firefox.src firefox.src as a component of Red Hat Enterprise Linux 7 | affected | no version stated vendor label: firefox.src | out of support | csaf_redhat | |
| red_hat_enterprise_linux_8:thunderbird::thunderbird:flatpak thunderbird (thunderbird:flatpak) as a component of Red Hat Enterprise Linux 8 | affected | no version stated vendor label: thunderbird::thunderbird:flatpak | no fix planned | csaf_redhat | |
| red_hat_enterprise_linux_7:thunderbird thunderbird as a component of Red Hat Enterprise Linux 7 | affected | no version stated vendor label: thunderbird | out of support | csaf_redhat | |
| red_hat_enterprise_linux_8:thunderbird.src::thunderbird:flatpak thunderbird.src (thunderbird:flatpak) as a component of Red Hat Enterprise Linux 8 | affected | no version stated vendor label: thunderbird.src::thunderbird:flatpak | no fix planned | csaf_redhat | |
| red_hat_enterprise_linux_7:thunderbird.src thunderbird.src as a component of Red Hat Enterprise Linux 7 | affected | no version stated vendor label: thunderbird.src | out of support | csaf_redhat | |
| red_hat_enterprise_linux_8:xmlrpc-c xmlrpc-c as a component of Red Hat Enterprise Linux 8 | affected | no version stated vendor label: xmlrpc-c | no fix planned | csaf_redhat | |
| red_hat_enterprise_linux_8:xmlrpc-c-c++ xmlrpc-c-c++ as a component of Red Hat Enterprise Linux 8 | affected | no version stated vendor label: xmlrpc-c-c++ | no fix planned | csaf_redhat | |
| red_hat_enterprise_linux_8:xmlrpc-c-client xmlrpc-c-client as a component of Red Hat Enterprise Linux 8 | affected | no version stated vendor label: xmlrpc-c-client | no fix planned | csaf_redhat | |
| red_hat_enterprise_linux_8:xmlrpc-c-client++ xmlrpc-c-client++ as a component of Red Hat Enterprise Linux 8 | affected | no version stated vendor label: xmlrpc-c-client++ | no fix planned | csaf_redhat | |
| red_hat_enterprise_linux_8:xmlrpc-c-devel xmlrpc-c-devel as a component of Red Hat Enterprise Linux 8 | affected | no version stated vendor label: xmlrpc-c-devel | no fix planned | csaf_redhat | |
| red_hat_enterprise_linux_8:xmlrpc-c.src xmlrpc-c.src as a component of Red Hat Enterprise Linux 8 | affected | no version stated vendor label: xmlrpc-c.src | no fix planned | csaf_redhat | |
| red_hat_enterprise_linux_8:expat expat as a component of Red Hat Enterprise Linux 8 | not affected vulnerable code not present | no version stated vendor label: expat | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:expat expat as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: expat | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_8:expat-devel expat-devel as a component of Red Hat Enterprise Linux 8 | not affected vulnerable code not present | no version stated vendor label: expat-devel | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:expat-devel expat-devel as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: expat-devel | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_8:expat.src expat.src as a component of Red Hat Enterprise Linux 8 | not affected vulnerable code not present | no version stated vendor label: expat.src | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:expat.src expat.src as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: expat.src | not applicable | csaf_redhat | |
| red_hat_jboss_core_services:expat.src expat.src as a component of Red Hat JBoss Core Services | not affected vulnerable code not present | no version stated vendor label: expat.src | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:firefox::firefox:flatpak firefox (firefox:flatpak) as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: firefox::firefox:flatpak | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_8:firefox firefox as a component of Red Hat Enterprise Linux 8 | not affected vulnerable code not present | no version stated vendor label: firefox | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:firefox firefox as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: firefox | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:firefox-x11::firefox:flatpak firefox-x11 (firefox:flatpak) as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | firefox-x11::firefox:flatpak | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:firefox-x11 firefox-x11 as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: firefox-x11 | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:firefox.src::firefox:flatpak firefox.src (firefox:flatpak) as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: firefox.src::firefox:flatpak | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_8:firefox.src firefox.src as a component of Red Hat Enterprise Linux 8 | not affected vulnerable code not present | no version stated vendor label: firefox.src | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:firefox.src firefox.src as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: firefox.src | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:thunderbird::thunderbird:flatpak thunderbird (thunderbird:flatpak) as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: thunderbird::thunderbird:flatpak | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_8:thunderbird thunderbird as a component of Red Hat Enterprise Linux 8 | not affected vulnerable code not present | no version stated vendor label: thunderbird | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:thunderbird thunderbird as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: thunderbird | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:thunderbird.src::thunderbird:flatpak thunderbird.src (thunderbird:flatpak) as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: thunderbird.src::thunderbird:flatpak | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_8:thunderbird.src thunderbird.src as a component of Red Hat Enterprise Linux 8 | not affected vulnerable code not present | no version stated vendor label: thunderbird.src | not applicable | csaf_redhat | |
| red_hat_enterprise_linux_9:thunderbird.src thunderbird.src as a component of Red Hat Enterprise Linux 9 | not affected vulnerable code not present | no version stated vendor label: thunderbird.src | not applicable | csaf_redhat | |
| https://github.com/libexpat/libexpat | affected | < 0f075ec8ecb5e43f8fdca5182f8cca4703da0404 | vendor fix → 0f075ec8ecb5e43f8fdca5182f8cca4703da0404 | osv | |
| https://github.com/libexpat/libexpat | fixed | 0f075ec8ecb5e43f8fdca5182f8cca4703da0404 | vendor fix → 0f075ec8ecb5e43f8fdca5182f8cca4703da0404 | osv | |
| n/a/n/a n/a · n/a | affected | no version stated vendor label: all versions | none available | cve_cna | |
| Siemens/SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Siemens · SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | affected | >= V3.1.0, < V3.1.5 | none available | cve_adp | |
| Siemens/SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Siemens · SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | affected | >= V3.1.0, < V3.1.5 | none available | cve_adp | |
| Siemens/SINEC NMS Siemens · SINEC NMS | affected | < V3.0 | none available | cve_adp | |
| Siemens/SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Siemens · SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | affected | >= V3.1.0, < V3.1.5 | none available | cve_adp |
A claim with no version range is shown as written rather than expanded: a government catalog naming only a vendor and product is a real statement at zero granularity, and inventing bounds for it would put precision in the record that the source never offered.