Automated analysis has detected that the following third party packages have had vulnerabilities publicly reported. 

NOTE: There may be several bugs listed below - in almost all cases, all bugs can be quickly addressed by upgrading to the latest version of the package.

Package Name: expat
Package Version: [cpe:/a:libexpat:expat:2.1.0]

Advisory: CVE-2012-6702
  Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2012-6702
  CVSS severity score: 4.3/10.0
  Confidence: high
  Description:

Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.
Advisory: CVE-2016-0718
  Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2016-0718
  CVSS severity score: 7.5/10.0
  Confidence: high
  Description:

Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
Advisory: CVE-2016-5300
  Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2016-5300
  CVSS severity score: 7.8/10.0
  Confidence: high
  Description:

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.