The 100.13.1 patch release of ArcGIS Runtime SDKs for Android, iOS, Java, .NET, and Qt is now available to resolve vulnerabilities identified in the Expat library used by ArcGIS Runtime. For 100.13.1 the version of Expat library has been updated to 2.4.6.
Expat is a 3rd-party library used by ArcGIS Runtime to provide stream-oriented XML parsing functionality. The library is used in open-source software like Apache, Mozilla, Perl, PHP, and Python, along with most Linux distributions.
Expat has recently patched vulnerabilities that expose XML processors to at least two exploit vectors: arbitrary code execution, or denial-of-service. ArcGIS Runtime 100.13.1 includes the patched version of the Expat library.
The 100.13.1 patch is complete (not an overlay) and follows the support lifecycle for ArcGIS Runtime 100.13 defined on the Esri Technical Support web site.
For more details see the release notes for Android, iOS, Qt, .NET, and Java.
To get 100.13.1, reference your API of choice through NuGet, Gradle, Swift Package Manager, or CocoaPods or go to the ArcGIS Developers downloads.
