CVE-2019-15903

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

• ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
• AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
• Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

6.64% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 93.7% of scored records. A rank, not a probability.

NVD base score

7.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-14.

Red Hat severity

Low. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2019-09-04 05:59Z7 YR AGO

Last updated

2026-10-14 06:50Z15 DAYS AGO

Reserved

2019-09-04

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Medium (CVSS 6.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses

• CWE-125Out-of-bounds ReadBase
• CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')Base

Data version

5.2

Document digest

ef8f34432c40bb5a0da4c3550b6472cea06463013c6cfeb26682a5f55445be60

• usn.ubuntu.comUSN-4132-1https://usn.ubuntu.com/4132-1/vendor-advisoryx_refsource_UBUNTU
• seclists.org20190917 [slackware-security] expat (SSA:2019-259-01)https://seclists.org/bugtraq/2019/Sep/30mailing-listx_refsource_BUGTRAQ
• usn.ubuntu.comUSN-4132-2https://usn.ubuntu.com/4132-2/vendor-advisoryx_refsource_UBUNTU
• lists.fedoraproject.orgFEDORA-2019-613edfe68bhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/vendor-advisoryx_refsource_FEDORA
• www.debian.orgDSA-4530https://www.debian.org/security/2019/dsa-4530vendor-advisoryx_refsource_DEBIAN
• seclists.org20190923 [SECURITY] [DSA 4530-1] expat security updatehttps://seclists.org/bugtraq/2019/Sep/37mailing-listx_refsource_BUGTRAQ
• lists.fedoraproject.orgFEDORA-2019-9505c6b555https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/vendor-advisoryx_refsource_FEDORA
• lists.opensuse.orgopenSUSE-SU-2019:2205http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.htmlvendor-advisoryx_refsource_SUSE
• lists.opensuse.orgopenSUSE-SU-2019:2204http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.htmlvendor-advisoryx_refsource_SUSE
• lists.fedoraproject.orgFEDORA-2019-672ae0f060https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/vendor-advisoryx_refsource_FEDORA
• seclists.org20191021 [slackware-security] python (SSA:2019-293-01)https://seclists.org/bugtraq/2019/Oct/29mailing-listx_refsource_BUGTRAQ
• usn.ubuntu.comUSN-4165-1https://usn.ubuntu.com/4165-1/vendor-advisoryx_refsource_UBUNTU
• www.debian.orgDSA-4549https://www.debian.org/security/2019/dsa-4549vendor-advisoryx_refsource_DEBIAN
• access.redhat.comRHSA-2019:3210https://access.redhat.com/errata/RHSA-2019:3210vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2019:3237https://access.redhat.com/errata/RHSA-2019:3237vendor-advisoryx_refsource_REDHAT
• seclists.org20191101 [SECURITY] [DSA 4549-1] firefox-esr security updatehttps://seclists.org/bugtraq/2019/Nov/1mailing-listx_refsource_BUGTRAQ
• lists.opensuse.orgopenSUSE-SU-2019:2420http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.htmlvendor-advisoryx_refsource_SUSE
• lists.opensuse.orgopenSUSE-SU-2019:2424http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.htmlvendor-advisoryx_refsource_SUSE
• lists.opensuse.orgopenSUSE-SU-2019:2425http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.htmlvendor-advisoryx_refsource_SUSE
• access.redhat.comRHSA-2019:3756https://access.redhat.com/errata/RHSA-2019:3756vendor-advisoryx_refsource_REDHAT
• lists.opensuse.orgopenSUSE-SU-2019:2447http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.htmlvendor-advisoryx_refsource_SUSE
• lists.opensuse.orgopenSUSE-SU-2019:2451http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.htmlvendor-advisoryx_refsource_SUSE
• lists.opensuse.orgopenSUSE-SU-2019:2452http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.htmlvendor-advisoryx_refsource_SUSE
• lists.opensuse.orgopenSUSE-SU-2019:2459http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.htmlvendor-advisoryx_refsource_SUSE
• lists.opensuse.orgopenSUSE-SU-2019:2464http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.htmlvendor-advisoryx_refsource_SUSE
• lists.debian.org[debian-lts-announce] 20191110 [SECURITY] [DLA 1987-1] firefox-esr security updatehttps://lists.debian.org/debian-lts-announce/2019/11/msg00006.htmlmailing-listx_refsource_MLIST
• seclists.org20191118 [SECURITY] [DSA 4571-1] thunderbird security updatehttps://seclists.org/bugtraq/2019/Nov/24mailing-listx_refsource_BUGTRAQ
• www.debian.orgDSA-4571https://www.debian.org/security/2019/dsa-4571vendor-advisoryx_refsource_DEBIAN
• lists.debian.org[debian-lts-announce] 20191118 [SECURITY] [DLA 1997-1] thunderbird security updatehttps://lists.debian.org/debian-lts-announce/2019/11/msg00017.htmlmailing-listx_refsource_MLIST
• security.gentoo.orgGLSA-201911-08https://security.gentoo.org/glsa/201911-08vendor-advisoryx_refsource_GENTOO
• usn.ubuntu.comUSN-4202-1https://usn.ubuntu.com/4202-1/vendor-advisoryx_refsource_UBUNTU
• seclists.org20191211 APPLE-SA-2019-12-10-8 watchOS 6.1.1https://seclists.org/bugtraq/2019/Dec/17mailing-listx_refsource_BUGTRAQ
• seclists.org20191211 APPLE-SA-2019-12-10-5 tvOS 13.3https://seclists.org/bugtraq/2019/Dec/21mailing-listx_refsource_BUGTRAQ
• seclists.org20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierrahttps://seclists.org/bugtraq/2019/Dec/23mailing-listx_refsource_BUGTRAQ
• seclists.org20191213 APPLE-SA-2019-12-10-1 iOS 13.3 and iPadOS 13.3http://seclists.org/fulldisclosure/2019/Dec/23mailing-listx_refsource_FULLDISC
• seclists.org20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierrahttp://seclists.org/fulldisclosure/2019/Dec/26mailing-listx_refsource_FULLDISC
• seclists.org20191213 APPLE-SA-2019-12-10-8 watchOS 6.1.1http://seclists.org/fulldisclosure/2019/Dec/30mailing-listx_refsource_FULLDISC
• seclists.org20191213 APPLE-SA-2019-12-10-5 tvOS 13.3http://seclists.org/fulldisclosure/2019/Dec/27mailing-listx_refsource_FULLDISC
• lists.opensuse.orgopenSUSE-SU-2020:0010http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.htmlvendor-advisoryx_refsource_SUSE
• lists.opensuse.orgopenSUSE-SU-2020:0086http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.htmlvendor-advisoryx_refsource_SUSE
• usn.ubuntu.comUSN-4335-1https://usn.ubuntu.com/4335-1/vendor-advisoryx_refsource_UBUNTU
• www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
• www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2020.htmlx_refsource_MISC
• github.comhttps://github.com/libexpat/libexpat/issues/317x_refsource_MISC
• github.comhttps://github.com/libexpat/libexpat/pull/318x_refsource_MISC
• github.comhttps://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43x_refsource_MISC
• github.comhttps://github.com/libexpat/libexpat/issues/342x_refsource_CONFIRM
• packetstormsecurity.comhttp://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.htmlx_refsource_MISC
• security.netapp.comhttps://security.netapp.com/advisory/ntap-20190926-0004/x_refsource_CONFIRM
• packetstormsecurity.comhttp://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.htmlx_refsource_MISC
• packetstormsecurity.comhttp://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.htmlx_refsource_MISC
• support.apple.comhttps://support.apple.com/kb/HT210788x_refsource_CONFIRM
• support.apple.comhttps://support.apple.com/kb/HT210790x_refsource_CONFIRM
• support.apple.comhttps://support.apple.com/kb/HT210785x_refsource_CONFIRM
• support.apple.comhttps://support.apple.com/kb/HT210789x_refsource_CONFIRM
• support.apple.comhttps://support.apple.com/kb/HT210793x_refsource_CONFIRM
• support.apple.comhttps://support.apple.com/kb/HT210795x_refsource_CONFIRM
• support.apple.comhttps://support.apple.com/kb/HT210794x_refsource_CONFIRM
• www.tenable.comhttps://www.tenable.com/security/tns-2021-11x_refsource_CONFIRM
• cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-398330.html