The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0011 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-43680:
      In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate in out-of-memory situations.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:22785 advisory.

    Expat is a C library for parsing XML documents.

    Security Fix(es):

    * expat: internal entity expansion (CVE-2013-0340)

    * expat: Large number of prefixed XML attributes on a single tag can crash libexpat (CVE-2021-45960)

    * expat: Integer overflow in doProlog in xmlparse.c (CVE-2021-46143)

    * expat: Integer overflow in addBinding in xmlparse.c (CVE-2022-22822)

    * expat: Integer overflow in build_model in xmlparse.c (CVE-2022-22823)

    * expat: Integer overflow in defineAttribute in xmlparse.c (CVE-2022-22824)

    * expat: Integer overflow in lookup in xmlparse.c (CVE-2022-22825)

    * expat: Integer overflow in nextScaffoldPart in xmlparse.c (CVE-2022-22826)

    * expat: Integer overflow in storeAtts in xmlparse.c (CVE-2022-22827)

    * expat: integer overflow in the doProlog function (CVE-2022-23990)

    * expat: Stack exhaustion in doctype parsing (CVE-2022-25313)

    * expat: Integer overflow in copyString() (CVE-2022-25314)

    * expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate     (CVE-2022-43680)

    * expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)

    * libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

    * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small     document that is submitted for parsing (CVE-2025-59375)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the expat package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:0103 advisory.

  - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Nessus application running on the remote host is 10.x prior to 10.3.2. It is, therefore, affected by multiple vulnerabilities, including:

  - A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking.
  (CVE-2022-3786, CVE-2022-3602)

  - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0012 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-43680:
    In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate in out-of-memory situations.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of expat installed on the remote host is prior to 2.5.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-261 advisory.

  - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ae2559a8f4 advisory.

    Update to 0.42.2, fixes CVE-2022-44638 and CVE-2022-43680.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-3cf0e7ebc7 advisory.

    Update to 0.42.2, fixes CVE-2022-44638 and CVE-2022-43680.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-4777:01 advisory.

    * expat: use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate (CVE-2022-43680)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:0103 advisory.

  - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in     XML_ExternalEntityParserCreate in out-of-memory situations. (CVE-2022-43680)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
239647	TencentOS Server 3: expat (TSSA-2023:0011)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	high
277504	RHEL 8 : expat (RHSA-2025:22785)	Nessus	Red Hat Local Security Checks	12/4/2025	12/4/2025	critical
176780	EulerOS Virtualization 2.11.0 : expat (EulerOS-SA-2023-2088)	Nessus	Huawei Local Security Checks	6/7/2023	6/7/2023	high
170088	AlmaLinux 8 : expat (ALSA-2023:0103)	Nessus	Alma Linux Local Security Checks	1/16/2023	9/7/2023	high
166959	Tenable Nessus 10.x < 10.3.2 Multiple Vulnerabilities (TNS-2022-23)	Nessus	Misc.	11/4/2022	10/5/2023	high
236116	Alibaba Cloud Linux 3 : 0012: expat (ALINUX3-SA-2023:0012)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	high
168551	Amazon Linux 2022 : expat (ALAS2022-2022-261)	Nessus	Amazon Linux Local Security Checks	12/9/2022	12/11/2024	high
169110	Fedora 35 : mingw-pixman (2022-ae2559a8f4)	Nessus	Fedora Local Security Checks	12/22/2022	11/14/2024	high
169125	Fedora 36 : mingw-pixman (2022-3cf0e7ebc7)	Nessus	Fedora Local Security Checks	12/22/2022	11/14/2024	high
292018	MiracleLinux 8 : expat-2.2.5-10.el8.1 (AXSA:2023-4777:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/20/2026	high
184514	Rocky Linux 8 : expat (RLSA-2023:0103)	Nessus	Rocky Linux Local Security Checks	11/6/2023	11/6/2023	high
225037	Linux Distros Unpatched Vulnerability : CVE-2022-43680	Nessus	Misc.	3/5/2025	9/2/2026	high

Detections

Analytics

Plugins Search

high

critical

high

high

high

high

high

high

high

high

high

high