Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
806b634c by Salvatore Bonaccorso at 2026-06-25T21:43:43+02:00
Track fixed version for expat issues in 2.8.2 release upstream
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -4280,43 +4280,43 @@ CVE-2026-11745 (A vulnerability has been identified in
centraldogma-server-mirro
CVE-2026-10530 (The Pie Register WordPress plugin before 3.8.4.10 does not
use suffic ...)
NOT-FOR-US: WordPress plugin
CVE-2026-56412 (libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in
doCdataS ...)
- - expat <unfixed> (bug #1140557)
+ - expat 2.8.2-1 (bug #1140557)
NOTE: https://github.com/libexpat/libexpat/pull/1278
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/d19e834794060d18c061d94452c35d725393ea58
CVE-2026-56411 (xmlwf in libexpat before 2.8.2 has an integer overflow in
endDoctypeDe ...)
- - expat <unfixed> (bug #1140557)
+ - expat 2.8.2-1 (bug #1140557)
NOTE: https://github.com/libexpat/libexpat/pull/1263
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/528a4e5017e1bd3b48b689fd0c131df940ae3ea5
CVE-2026-56410 (xmlwf in libexpat before 2.8.2 has an integer overflow in
resolveSyste ...)
- - expat <unfixed> (bug #1140557)
+ - expat 2.8.2-1 (bug #1140557)
NOTE: https://github.com/libexpat/libexpat/pull/1252
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/deeb97f7c88d17a16b0ea2521a13733abc283347
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/cee20e91bf14dc7f6d2fc48f0d70d86b2dc3afea
CVE-2026-56409 (xmlwf in libexpat before 2.8.2 has an integer overflow for the
output ...)
- - expat <unfixed> (bug #1140557)
+ - expat 2.8.2-1 (bug #1140557)
NOTE: https://github.com/libexpat/libexpat/pull/1259
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e
CVE-2026-56408 (libexpat before 2.8.2 has an integer overflow in copyString.)
- - expat <unfixed> (bug #1140557)
+ - expat 2.8.2-1 (bug #1140557)
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817
CVE-2026-56407 (libexpat before 2.8.2 has an integer overflow in doProlog that
is rela ...)
- - expat <unfixed> (bug #1140557)
+ - expat 2.8.2-1 (bug #1140557)
NOTE: https://github.com/libexpat/libexpat/pull/1262
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13
CVE-2026-56406 (libexpat before 2.8.2 has an integer overflow in
XML_ParseBuffer becau ...)
- - expat <unfixed> (bug #1140557)
+ - expat 2.8.2-1 (bug #1140557)
NOTE: https://github.com/libexpat/libexpat/pull/1255
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/99d8454fdf900a6d00c2a52748e6c0eeb507574d
CVE-2026-56405 (libexpat before 2.8.2 has an integer overflow in
getAttributeId.)
- - expat <unfixed> (bug #1140557)
+ - expat 2.8.2-1 (bug #1140557)
NOTE: https://github.com/libexpat/libexpat/pull/1251
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/2c6c42d33689f6b266a5267b639e03cde17e53c0
CVE-2026-56404 (libexpat before 2.8.2 has an integer overflow in addBinding.)
- - expat <unfixed> (bug #1140557)
+ - expat 2.8.2-1 (bug #1140557)
NOTE: https://github.com/libexpat/libexpat/pull/1249
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/babfc48090977cbf7be24b2c48f6053dca75c164
CVE-2026-56403 (libexpat before 2.8.2 has an integer overflow in storeAtts.)
- - expat <unfixed> (bug #1140557)
+ - expat 2.8.2-1 (bug #1140557)
NOTE: https://github.com/libexpat/libexpat/pull/1232
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15
@@ -4963,10 +4963,10 @@ CVE-2026-7515 (The BetterDocs Pro plugin for WordPress
is vulnerable to Local Fi
CVE-2026-6716
REJECTED
CVE-2026-56132 (In libexpat before 2.8.2, there is a heap-based buffer
overflow in doP ...)
- - expat <unfixed> (bug #1140388)
+ - expat 2.8.2-1 (bug #1140388)
NOTE: https://github.com/libexpat/libexpat/pull/1272
CVE-2026-56131 (libexpat before 2.8.2 lacks handler call depth tracking for
calls to X ...)
- - expat <unfixed> (bug #1140387)
+ - expat 2.8.2-1 (bug #1140387)
NOTE: https://github.com/libexpat/libexpat/pull/1267
CVE-2026-56099 (OpenBSD before commit 6a23123 (2026-06-18) contains an
out-of-bounds r ...)
NOT-FOR-US: OpenBSD
@@ -15796,7 +15796,7 @@ CVE-2026-50292 (In libinput before 1.30.4 and 1.31.x
before 1.31.3, libinput-dev
NOTE: Fixed by:
https://gitlab.freedesktop.org/libinput/libinput/-/commit/b2bde9504d42a5976d76e1f27c640dc561fbd99b
(1.30.4)
NOTE: https://www.openwall.com/lists/oss-security/2026/06/04/5
CVE-2026-50219 (libexpat before 2.8.2 lacks handler call depth tracking for
calls to X ...)
- - expat <unfixed> (bug #1138862)
+ - expat 2.8.2-1 (bug #1138862)
NOTE: https://github.com/libexpat/libexpat/pull/1246
CVE-2026-8829 (HTML::Entities versions before 3.84 for Perl read freed heap
memory in ...)
- libhtml-parser-perl 3.83-2
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/806b634c9d81a16f96d5f7f8c67adacc32919bda
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/806b634c9d81a16f96d5f7f8c67adacc32919bda
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
