expat 2.1.1 fixes MEDIUM-rated CVE-2015-1283. I’ve uploaded the regular expat 2.1.1 packages, but the cross-development packages maintained by Yaakov are all at 2.1.0. Some appear to have 2.1.1 alternate versions available