Hi, Sorry, the debdiff attached to my previous mail is damaged: the final hunk (debian/patches/series) lost two context lines, so it won't apply. The corrected debdiff is attached here (sha256 82d5d003d8166506e8daadc8c5f38cf90c563d3c726b6bd9ff18c64336787550). It applies cleanly to 2.5.0-1+deb12u5. Nothing else has changed.
Regards, Sumit Verma On Thu, Nov 05, 2026 03:27 PM, Sumit Verma <[email protected]> wrote: > Hi, > > bookworm's expat (2.5.0-1+deb12u5) is still open for four CVEs that > 2.10.0-1 fixed in unstable: CVE-2026-113351 (<postponed>), CVE-2026-115506, > CVE-2026-117610 and CVE-2026-118370. expat isn't in dla-needed.txt, and the > debian/bookworm branch in lts-team/packages/expat is still at deb12u5, so I > prepared backports of three of them on top of deb12u5. The debdiff is > attached; please use as much or as little of it as is useful. I'm not on > the LTS team and can't upload. > > CVE-2026-117610 (upstream PR #1444) > The library change applies unchanged. The bug does affect deb12u5: I ran > upstream's test scenario (external entity subparser, an empty non-final > XML_Parse(), then a document containing a PI) as a small standalone program > under ASan+UBSan. On deb12u5, reportProcessingInstruction() reads > enc->minBytesPerChar from uninitialized heap memory (UBSan: "signed integer > overflow: -1094795586 * 2", i.e. ASan's 0xbe fill), deterministically. The > same program SEGVs on upstream R_2_9_0. With the patch it runs clean and > the handler gets target="target", data="data". The upstream regression test > is ported into tests/runtests.c. Note that without sanitizers the ported > test happened to pass on deb12u5 as well, since the uninitialized memory > held usable values. > > CVE-2026-113351 (upstream PR #1431) > The CVE text says 2.7.2 and later, but deb12u4 backported the 2.7.2 > allocation tracker (CVE-2025-59375), so bookworm is affected, as the > tracker says. I ported the two upstream tests: both fail on deb12u5 (after > XML_ParserReset() the amplification limit set by the application is lost, > and after one large document a small one is refused with > XML_ERROR_NO_MEMORY), and both pass with the patch. The 2.5.0 differences > (XmlBigCount, XML_DTD guard) are noted in the patch header. > > CVE-2026-118370 (upstream PR #1450) > Hand-ported, because storeAtts() in 2.5.0 shares one "int i" between > several loops; the loops over attIndex get their own size_t counters. Not > reproduced, since triggering it needs more than 2^31 attributes; the > affected code is the same as upstream before the fix. > > Not included: > - CVE-2026-115506 (PR #1433): this adds about 400 lines of new code that > precompute entity expansion sizes, to cut the CPU time of a billion-laughs > style DoS. I don't think it is a reasonable backport for 2.5.0, so I'm > leaving that decision to you. > - CVE-2025-66382: no upstream fix yet. > > Side finding: tests/runtests on deb12u5 fails 1 of 365 checks > (test_nsalloc_realloc_attributes). I bisected the series to > CVE-2025-59375-10.patch: the same upstream commit (cfce28e17167) also > changed that test's expectation for XML_GE=1, but the backport didn't carry > the test change over. debian/rules builds the tests but never runs them, > which is presumably why it went unnoticed. The debdiff adds the test change > as CVE-2025-59375-tests.patch. > > Testing: > - All 74 patches apply to the orig tarball with no fuzz or offset, and > dpkg-source -b builds the source package. > - Built with upstream's CMake build and -DXML_GE=1 as in debian/rules > (automake isn't available on my build host, so Debian's autotools build was > NOT run; the CMake build needed XML_DTD/XML_NS set to 1 in the generated > expat_config.h, because the earlier backports use "#if XML_DTD == 1"). > - runtests and runtestspp: 368/368 with -O2, and 368/368 with > ASan+UBSan+LSan with no sanitizer reports. Unpatched deb12u5 in the same > setup: 364/365. > - The library also compiles with -DXML_UNICODE (libexpatw) and adds no new > compiler warnings. > > Regards, > Sumit Verma >
expat_2.5.0-1+deb12u6.debdiff
Description: Binary data
