Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.
Conclusion & alert: CVE-2015-1283 is rated Moderate Risk (50.6/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 0.52%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-03-04 | 0.37% | 0.52% | +0.15% |
| 2 | 2026-03-01 | 0.52% | 0.37% | -0.15% |
| 3 | 2026-02-21 | — | 0.52% | — |
Full EPSS history (44 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 6.8 | 2.0 | MEDIUM |
|
8.6 | 6.4 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2015-1283 not yet assigned priority: Debian including 2 source packages (expat, libxmltok), 7 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5, open 2. | https://security-tracker.debian.org/tracker/CVE-2015-1283 |
gentoo
|
normal | CVE-2015-1283: 2 GLSA(s) (201603-09, 201701-21), 2 atom(s) (dev-libs/expat, www-client/chromium); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2015-1283 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2015-1283 |
suse
|
medium | CVE-2015-1283 severity moderate: SUSE including 323 source package names (0.9.1:expat-2.1.0-17.1, 0.9.1:libexpat1-2.1.0-17.1, …), 528 product×package rows across 107 product lines (Container caasp/v4/default-http-backend, Container caasp/v4/dnsmasq-nanny, … (107 product lines)): Fixed 285, Known Affected 157, Known Not Affected 86. | https://www.suse.com/security/cve/CVE-2015-1283/ |
ubuntu
|
medium | CVE-2015-1283 medium priority: Ubuntu including 33 source packages (apache2, apr-util, …), 847 status rows across 26 suites (artful, bionic, cosmic, disco, eoan, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, precise, questing, trusty, upstream, utopic, vivid, wily, xenial, yakkety, zesty): not-affected 335, DNE 228, ignored 183, released 45, needed 39, needs-triage 17. | https://ubuntu.com/security/CVE-2015-1283 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| chrome | <= 43.0.2357.134 | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | |
| libexpat_project | libexpat | <= 2.1.0 | cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* |
| python | python | >= 2.7.0, < 2.7.12 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| python | python | >= 3.3.0, < 3.3.7 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| python | python | >= 3.4.0, < 3.4.5 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| python | python | >= 3.5.0, < 3.5.2 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| debian | debian_linux | 7.0 | cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
| debian | debian_linux | 8.0 | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| debian | debian_linux | 9.0 | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| canonical | ubuntu_linux | 12.04 | cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* |
| canonical | ubuntu_linux | 14.04 | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* |
| canonical | ubuntu_linux | 15.04 | cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:* |
| suse | linux_enterprise_debuginfo | 11 | cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:* |
| suse | studio_onsite | 1.3 | cpe:2.3:a:suse:studio_onsite:1.3:*:*:*:*:*:*:* |
| opensuse | leap | 42.1 | cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:* |
| opensuse | opensuse | 13.1 | cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* |
| opensuse | opensuse | 13.2 | cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* |
| suse | linux_enterprise_desktop | 12 | cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:* |
| suse | linux_enterprise_desktop | 12 | cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:* |
| suse | linux_enterprise_server | 11 | cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:* |
| suse | linux_enterprise_server | 12 | cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:* |
| suse | linux_enterprise_server | 12 | cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:* |
| suse | linux_enterprise_software_development_kit | 11 | cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:* |
| suse | linux_enterprise_software_development_kit | 12 | cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:* |
| suse | linux_enterprise_software_development_kit | 12 | cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:* |
| oracle | solaris | 10 | cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:* |
| oracle | solaris | 11.3 | cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:* |