From de6adf1dd15675fed5a49e5c0f6f74c8b9654a91 Mon Sep 17 00:00:00 2001
From: Salvatore Bonaccorso <carnil@debian.org>
Date: Fri, 18 Feb 2022 20:44:17 +0100
Subject: Reference commits for CVE-2022-25236/expat

---
 data/CVE/2022.list | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/data/CVE/2022.list b/data/CVE/2022.list
index 7e8dff8f5b..d3f52d2cdd 100644
--- a/data/CVE/2022.list
+++ b/data/CVE/2022.list
@@ -314,6 +314,9 @@ CVE-2022-25237
 CVE-2022-25236 (xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to in ...)
 	- expat <unfixed> (bug #1005895)
 	NOTE: https://github.com/libexpat/libexpat/pull/561
+	NOTE: https://github.com/libexpat/libexpat/commit/6881a4fc8596307ab9ff2e85e605afa2e413ab71
+	NOTE: https://github.com/libexpat/libexpat/commit/a2fe525e660badd64b6c557c2b1ec26ddc07f6e4
+	NOTE: https://github.com/libexpat/libexpat/commit/2de077423fb22750ebea599677d523b53cb93b1d
 CVE-2022-25235 (xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain valid ...)
 	- expat <unfixed> (bug #1005894)
 	NOTE: https://github.com/libexpat/libexpat/pull/562
-- 
cgit v1.2.3