* gnu/packages/patches/expat-CVE-2015-1283-refix.patch,
gnu/packages/patches/expat-CVE-2016-0718.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
* gnu/packages/xml.scm (expat)[replacement]: New field.
(expat/fixed): New variable.
[source]: Use new patches.