diff -Nru expat-2.4.8/debian/changelog expat-2.4.8/debian/changelog
--- expat-2.4.8/debian/changelog	2022-03-29 20:01:08.000000000 +0000
+++ expat-2.4.8/debian/changelog	2022-09-15 18:53:15.000000000 +0000
@@ -1,3 +1,10 @@
+expat (2.4.8-2) unstable; urgency=high
+
+  * Backport security fix for CVE-2022-40674: heap use-after-free issue in
+    doContent() (closes: #1019761).
+
+ -- Laszlo Boszormenyi (GCS) <gcs@debian.org>  Thu, 15 Sep 2022 20:53:15 +0200
+
 expat (2.4.8-1) unstable; urgency=medium
 
   * New upstream release.
diff -Nru expat-2.4.8/debian/patches/CVE-2022-40674_addon.patch expat-2.4.8/debian/patches/CVE-2022-40674_addon.patch
--- expat-2.4.8/debian/patches/CVE-2022-40674_addon.patch	1970-01-01 00:00:00.000000000 +0000
+++ expat-2.4.8/debian/patches/CVE-2022-40674_addon.patch	2022-09-15 18:53:15.000000000 +0000
@@ -0,0 +1,134 @@
+From a7ce80a013f2a08cb1ac4aac368f2250eea03ebf Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sun, 11 Sep 2022 19:34:33 +0200
+Subject: [PATCH 1/2] tests: Cover heap use-after-free issue in doContent
+
+---
+ expat/tests/runtests.c | 74 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 74 insertions(+)
+
+diff --git a/expat/tests/runtests.c b/expat/tests/runtests.c
+index ea371b42f..ab3aff65b 100644
+--- a/expat/tests/runtests.c
++++ b/expat/tests/runtests.c
+@@ -4990,6 +4990,78 @@ START_TEST(test_suspend_resume_internal_entity) {
+ }
+ END_TEST
+ 
++void
++suspending_comment_handler(void *userData, const XML_Char *data) {
++  UNUSED_P(data);
++  XML_Parser parser = (XML_Parser)userData;
++  XML_StopParser(parser, XML_TRUE);
++}
++
++START_TEST(test_suspend_resume_internal_entity_issue_629) {
++  const char *const text
++      = "<!DOCTYPE a [<!ENTITY e '<!--COMMENT-->a'>]><a>&e;<b>\n"
++        "<"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
++        "/>"
++        "</b></a>";
++  const size_t firstChunkSizeBytes = 54;
++
++  XML_Parser parser = XML_ParserCreate(NULL);
++  XML_SetUserData(parser, parser);
++  XML_SetCommentHandler(parser, suspending_comment_handler);
++
++  if (XML_Parse(parser, text, (int)firstChunkSizeBytes, XML_FALSE)
++      != XML_STATUS_SUSPENDED)
++    xml_failure(parser);
++  if (XML_ResumeParser(parser) != XML_STATUS_OK)
++    xml_failure(parser);
++  if (XML_Parse(parser, text + firstChunkSizeBytes,
++                (int)(strlen(text) - firstChunkSizeBytes), XML_TRUE)
++      != XML_STATUS_OK)
++    xml_failure(parser);
++  XML_ParserFree(parser);
++}
++END_TEST
++
+ /* Test syntax error is caught at parse resumption */
+ START_TEST(test_resume_entity_with_syntax_error) {
+   const char *text = "<!DOCTYPE doc [\n"
+@@ -12016,6 +12088,8 @@ make_suite(void) {
+   tcase_add_test(tc_basic, test_partial_char_in_epilog);
+   tcase_add_test(tc_basic, test_hash_collision);
+   tcase_add_test__ifdef_xml_dtd(tc_basic, test_suspend_resume_internal_entity);
++  tcase_add_test__ifdef_xml_dtd(tc_basic,
++                                test_suspend_resume_internal_entity_issue_629);
+   tcase_add_test__ifdef_xml_dtd(tc_basic, test_resume_entity_with_syntax_error);
+   tcase_add_test__ifdef_xml_dtd(tc_basic, test_suspend_resume_parameter_entity);
+   tcase_add_test(tc_basic, test_restart_on_error);
+
+From 721169eeca509ba93be6c73d0abe1caf5d218b9c Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sun, 11 Sep 2022 20:38:09 +0200
+Subject: [PATCH 2/2] Changes: Document heap use-after-free CVE-2022-40674
+
+---
+ expat/Changes | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/expat/Changes b/expat/Changes
+index dbb23c3b4..ccfdbc199 100644
+--- a/expat/Changes
++++ b/expat/Changes
+@@ -2,6 +2,18 @@ NOTE: We are looking for help with a few
+       https://github.com/libexpat/libexpat/labels/help%20wanted
+       If you can help, please get in touch.  Thanks!
+ 
++Release x.x.x xxx xxxxx xx xxxx
++        Security fixes:
++        #629 #640  CVE-2022-40674 -- Heap use-after-free vulnerability in
++                    function doContent. Expected impact is denial of service
++                    or potentially arbitrary code execution.
++
++        Special thanks to:
++            Felix Wilhelm
++            Rhodri James
++                 and
++            Google Project Zero
++
+ Release 2.4.8 Mon March 28 2022
+         Other changes:
+             #587  pkg-config: Move "-lm" to section "Libs.private"
diff -Nru expat-2.4.8/debian/patches/CVE-2022-40674.patch expat-2.4.8/debian/patches/CVE-2022-40674.patch
--- expat-2.4.8/debian/patches/CVE-2022-40674.patch	1970-01-01 00:00:00.000000000 +0000
+++ expat-2.4.8/debian/patches/CVE-2022-40674.patch	2022-09-15 18:53:15.000000000 +0000
@@ -0,0 +1,49 @@
+From 4a32da87e931ba54393d465bb77c40b5c33d343b Mon Sep 17 00:00:00 2001
+From: Rhodri James <rhodri@wildebeest.org.uk>
+Date: Wed, 17 Aug 2022 18:26:18 +0100
+Subject: [PATCH] Ensure raw tagnames are safe exiting internalEntityParser
+
+It is possible to concoct a situation in which parsing is
+suspended while substituting in an internal entity, so that
+XML_ResumeParser directly uses internalEntityProcessor as
+its processor.  If the subsequent parse includes some unclosed
+tags, this will return without calling storeRawNames to ensure
+that the raw versions of the tag names are stored in memory other
+than the parse buffer itself.  If the parse buffer is then changed
+or reallocated (for example if processing a file line by line),
+badness will ensue.
+
+This patch ensures storeRawNames is always called when needed
+after calling doContent.  The earlier call do doContent does
+not need the same protection; it only deals with entity
+substitution, which cannot leave unbalanced tags, and in any
+case the raw names will be pointing into the stored entity
+value not the parse buffer.
+---
+ expat/lib/xmlparse.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 7bcabf7f4..d73f419cf 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -5826,10 +5826,15 @@ internalEntityProcessor(XML_Parser parser, const char *s, const char *end,
+   {
+     parser->m_processor = contentProcessor;
+     /* see externalEntityContentProcessor vs contentProcessor */
+-    return doContent(parser, parser->m_parentParser ? 1 : 0, parser->m_encoding,
+-                     s, end, nextPtr,
+-                     (XML_Bool)! parser->m_parsingStatus.finalBuffer,
+-                     XML_ACCOUNT_DIRECT);
++    result = doContent(parser, parser->m_parentParser ? 1 : 0,
++                       parser->m_encoding, s, end, nextPtr,
++                       (XML_Bool)! parser->m_parsingStatus.finalBuffer,
++                       XML_ACCOUNT_DIRECT);
++    if (result == XML_ERROR_NONE) {
++      if (! storeRawNames(parser))
++        return XML_ERROR_NO_MEMORY;
++    }
++    return result;
+   }
+ }
+ 
diff -Nru expat-2.4.8/debian/patches/series expat-2.4.8/debian/patches/series
--- expat-2.4.8/debian/patches/series	2022-02-21 20:08:18.000000000 +0000
+++ expat-2.4.8/debian/patches/series	2022-09-15 18:53:15.000000000 +0000
@@ -1,2 +1,4 @@
 fix-expat-noconfig.patch
 fix-expat-cmake.patch
+CVE-2022-40674.patch
+CVE-2022-40674_addon.patch