diff --git a/expat-CVE-2022-25235.patch b/expat-CVE-2022-25235.patch
new file mode 100644
index 0000000000000000000000000000000000000000..1e5c66498626d733e43a8d9e269b371aec221a19
--- /dev/null
+++ b/expat-CVE-2022-25235.patch
@@ -0,0 +1,49 @@
+diff -up firefox-91.7.0/parser/expat/lib/xmltok.c.expat-CVE-2022-25235 firefox-91.7.0/parser/expat/lib/xmltok.c
+--- firefox-91.7.0/parser/expat/lib/xmltok.c.expat-CVE-2022-25235	2022-03-02 17:57:38.364361168 +0100
++++ firefox-91.7.0/parser/expat/lib/xmltok.c	2022-03-02 17:58:22.235512399 +0100
+@@ -65,13 +65,6 @@
+                       + ((((byte)[2]) >> 5) & 1)] \
+          & (1u << (((byte)[2]) & 0x1F)))
+ 
+-#define UTF8_GET_NAMING(pages, p, n) \
+-  ((n) == 2 \
+-  ? UTF8_GET_NAMING2(pages, (const unsigned char *)(p)) \
+-  : ((n) == 3 \
+-     ? UTF8_GET_NAMING3(pages, (const unsigned char *)(p)) \
+-     : 0))
+-
+ /* Detection of invalid UTF-8 sequences is based on Table 3.1B
+    of Unicode 3.2: http://www.unicode.org/unicode/reports/tr28/
+    with the additional restriction of not allowing the Unicode
+diff -up firefox-91.7.0/parser/expat/lib/xmltok_impl.c.expat-CVE-2022-25235 firefox-91.7.0/parser/expat/lib/xmltok_impl.c
+--- firefox-91.7.0/parser/expat/lib/xmltok_impl.c.expat-CVE-2022-25235	2022-03-02 17:57:38.365361172 +0100
++++ firefox-91.7.0/parser/expat/lib/xmltok_impl.c	2022-03-02 18:04:51.240853247 +0100
+@@ -34,7 +34,7 @@
+    case BT_LEAD ## n: \
+      if (end - ptr < n) \
+        return XML_TOK_PARTIAL_CHAR; \
+-     if (!IS_NAME_CHAR(enc, ptr, n)) { \
++     if (IS_INVALID_CHAR(enc, ptr, n) || ! IS_NAME_CHAR(enc, ptr, n)) { \
+        *nextTokPtr = ptr; \
+        return XML_TOK_INVALID; \
+      } \
+@@ -62,7 +62,7 @@
+    case BT_LEAD ## n: \
+      if (end - ptr < n) \
+        return XML_TOK_PARTIAL_CHAR; \
+-     if (!IS_NMSTRT_CHAR(enc, ptr, n)) { \
++     if (IS_INVALID_CHAR(enc, ptr, n) || ! IS_NMSTRT_CHAR(enc, ptr, n)) { \
+        *nextTokPtr = ptr; \
+        return XML_TOK_INVALID; \
+      } \
+@@ -1090,6 +1090,10 @@ PREFIX(prologTok)(const ENCODING *enc, c
+   case BT_LEAD ## n: \
+     if (end - ptr < n) \
+       return XML_TOK_PARTIAL_CHAR; \
++    if (IS_INVALID_CHAR(enc, ptr, n)) {                                        \
++      *nextTokPtr = ptr;                                                       \
++      return XML_TOK_INVALID;                                                  \
++    }                                                                          \
+     if (IS_NMSTRT_CHAR(enc, ptr, n)) { \
+       ptr += n; \
+       tok = XML_TOK_NAME; \
diff --git a/expat-CVE-2022-25236.patch b/expat-CVE-2022-25236.patch
new file mode 100644
index 0000000000000000000000000000000000000000..2065dc9e986849c32c1ff2fe0262debea867b283
--- /dev/null
+++ b/expat-CVE-2022-25236.patch
@@ -0,0 +1,40 @@
+diff -up firefox-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25236 firefox-91.7.0/parser/expat/lib/xmlparse.c
+--- firefox-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25236	2022-03-02 18:08:40.085642028 +0100
++++ firefox-91.7.0/parser/expat/lib/xmlparse.c	2022-03-02 18:13:31.838667958 +0100
+@@ -700,8 +700,7 @@ XML_ParserCreate(const XML_Char *encodin
+ XML_Parser XMLCALL
+ XML_ParserCreateNS(const XML_Char *encodingName, XML_Char nsSep)
+ {
+-  XML_Char tmp[2];
+-  *tmp = nsSep;
++  XML_Char tmp[2] = {nsSep, 0};
+   return XML_ParserCreate_MM(encodingName, NULL, tmp);
+ }
+ #endif
+@@ -1276,8 +1275,7 @@ XML_ExternalEntityParserCreate(XML_Parse
+      would be otherwise.
+   */
+   if (ns) {
+-    XML_Char tmp[2];
+-    *tmp = namespaceSeparator;
++    XML_Char tmp[2] = {parser->m_namespaceSeparator, 0};
+     parser = parserCreate(encodingName, &parser->m_mem, tmp, newDtd);
+   }
+   else {
+@@ -3667,6 +3665,16 @@ addBinding(XML_Parser parser, PREFIX *pr
+     if (!mustBeXML && isXMLNS
+         && (len > xmlnsLen || uri[len] != xmlnsNamespace[len]))
+       isXMLNS = XML_FALSE;
++    // NOTE: While Expat does not validate namespace URIs against RFC 3986,
++    //       we have to at least make sure that the XML processor on top of
++    //       Expat (that is splitting tag names by namespace separator into
++    //       2- or 3-tuples (uri-local or uri-local-prefix)) cannot be confused
++    //       by an attacker putting additional namespace separator characters
++    //       into namespace declarations.  That would be ambiguous and not to
++    //       be expected.
++    if (parser->m_ns && (uri[len] == parser->m_namespaceSeparator)) {
++      return XML_ERROR_SYNTAX;
++    }
+   }
+   isXML = isXML && len == xmlLen;
+   isXMLNS = isXMLNS && len == xmlnsLen;
diff --git a/expat-CVE-2022-25315.patch b/expat-CVE-2022-25315.patch
new file mode 100644
index 0000000000000000000000000000000000000000..171980fbe9643255959d07e9424c12ab4975e346
--- /dev/null
+++ b/expat-CVE-2022-25315.patch
@@ -0,0 +1,24 @@
+diff -up firefox-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25315 firefox-91.7.0/parser/expat/lib/xmlparse.c
+--- firefox-91.7.0/parser/expat/lib/xmlparse.c.expat-CVE-2022-25315	2022-03-02 18:17:50.966583254 +0100
++++ firefox-91.7.0/parser/expat/lib/xmlparse.c	2022-03-02 18:19:27.636924735 +0100
+@@ -2479,6 +2479,7 @@ storeRawNames(XML_Parser parser)
+   while (tag) {
+     int bufSize;
+     int nameLen = sizeof(XML_Char) * (tag->name.strLen + 1);
++    size_t rawNameLen;
+     char *rawNameBuf = tag->buf + nameLen;
+     /* Stop if already stored.  Since tagStack is a stack, we can stop
+        at the first entry that has already been copied; everything
+@@ -2490,7 +2491,11 @@ storeRawNames(XML_Parser parser)
+     /* For re-use purposes we need to ensure that the
+        size of tag->buf is a multiple of sizeof(XML_Char).
+     */
+-    bufSize = nameLen + ROUND_UP(tag->rawNameLength, sizeof(XML_Char));
++    rawNameLen = ROUND_UP(tag->rawNameLength, sizeof(XML_Char));
++    /* Detect and prevent integer overflow. */
++    if (rawNameLen > (size_t)INT_MAX - nameLen)
++      return XML_FALSE;
++    bufSize = nameLen + (int)rawNameLen;
+     if (bufSize > tag->bufEnd - tag->buf) {
+       char *temp = (char *)REALLOC(tag->buf, bufSize);
+       if (temp == NULL)
diff --git a/firefox.spec b/firefox.spec
index bffd22dd4272222dab88d1084f786397fb2ce7be..ae3d3b492c91b57c322a6e372d048d94406675ee 100644
--- a/firefox.spec
+++ b/firefox.spec
@@ -88,7 +88,7 @@
 Summary:             Mozilla Firefox Web browser
 Name:                firefox
 Version:             79.0
-Release:             11
+Release:             12
 URL:                 https://www.mozilla.org/firefox/
 License:             MPLv1.1 or GPLv2+ or LGPLv2+
 Source0:             https://archive.mozilla.org/pub/firefox/releases/%{version}/source/firefox-%{version}.source.tar.xz
@@ -186,7 +186,14 @@ Patch641:            Bug-1680166-GCC-is-smarter-than-clang-so-ignore-the-warning
 Patch642:            firefox-glibc-dynstack.patch
 Patch643:            firefox-crashreporter-build.patch
 Patch644:            Deny-clone3-to-force-glibc-fallback.patch
-Patch645:		     0001-fix-wl_proxy_marshal_flags.patch
+Patch645:            0001-fix-wl_proxy_marshal_flags.patch
+# https://github.com/libexpat/libexpat/pull/562
+Patch646:            expat-CVE-2022-25235.patch
+# https://github.com/libexpat/libexpat/pull/561
+Patch647:            expat-CVE-2022-25236.patch
+# https://github.com/libexpat/libexpat/pull/559
+Patch648:            expat-CVE-2022-25315.patch
+
 
 %if %{?system_nss}
 BuildRequires:       pkgconfig(nspr) >= %{nspr_version} pkgconfig(nss) >= %{nss_version}
@@ -367,6 +374,9 @@ tar -xf %{SOURCE3}
 %patch643 -p1
 %patch644 -p1
 %patch645 -p1
+%patch646 -p1
+%patch647 -p1
+%patch648 -p1
 
 %{__rm} -f .mozconfig
 %{__cp} %{SOURCE10} .mozconfig
@@ -809,6 +819,9 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 %endif
 
 %changelog
+* Thu Mar 17 2022 wangkai <wangkai385@huawei.com> - 79.0-12
+- Added expat backports of CVE-2022-25235, CVE-2022-25236 and CVE-2022-25315
+
 * Tue Jan 11 2022 baizhonggui <baizhonggui@huawei.com> - 79.0-11
 - Fix firefox wl_proxy_marshal_flags undefine.