Public bug reported:
A new release of expat is available for merging from Debian.
Ubuntu: 2.8.3-1ubuntu1
Debian Unstable: 2.9.0-1
### New Debian Changes ###
expat (2.9.0-1) unstable; urgency=high
* New upstream release:
- fixes CVE-2026-77214: validate parameter len against available buffer
capacity in XML_ParseBuffer(),
- fixes CVE-2026-102633: integer overflow in function expat_realloc()
on 32bit platforms.
* Update libexpat1 symbols.
-- Laszlo Boszormenyi (GCS) <[email protected]> Mon, 05 Oct 2026 22:04:46
+0200
expat (2.8.5-2) unstable; urgency=high
* Backport upstream fixes for CVE-2026-102633: replace assert with runtime
overflow check in expat_realloc (closes: #1149507).
-- Laszlo Boszormenyi (GCS) <[email protected]> Wed, 30 Sep 2026 16:38:52
+0200
expat (2.8.5-1) unstable; urgency=medium
* New upstream release.
-- Laszlo Boszormenyi (GCS) <[email protected]> Sun, 27 Sep 2026 08:45:04
+0200
expat (2.8.4-2) unstable; urgency=high
* Backport upstream fixes for CVE-2026-93990: fails to validate low
surrogates following high surrogates in UTF-16 input (closes: #1148665).
-- Laszlo Boszormenyi (GCS) <[email protected]> Tue, 22 Sep 2026 06:48:48
+0200
expat (2.8.4-1) unstable; urgency=high
* New upstream release:
- fixes CVE-2026-66046 and CVE-2026-76641: fix quadratic runtime from
"attribute isCdata lookups" that allowed denial of service attacks,
- fixes CVE-2026-76957: protect custom encoding callbacks from parser
re-entry,
- fixes CVE-2026-76956: fix inverted getentropy() return handling.
-- Laszlo Boszormenyi (GCS) <[email protected]> Mon, 31 Aug 2026 18:48:23
+0200
### Old Ubuntu Delta ###
expat (2.8.3-1ubuntu1) stonking; urgency=medium
* SECURITY UPDATE: denial of service (algorithmic complexity of storeAtts())
- debian/patches/CVE-2026-66046-1.patch: lib: Rename hash table
`defaultAttsNames` to `defaultAttForName` in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-66046-2.patch: lib: Migrate .isCdata lookup from a
linear loop to a hash table lookup in expat/lib/xmlparse.c.
- CVE-2026-66046
* SECURITY UPDATE: out-of-bounds read
- debian/patches/CVE-2026-76641.patch: lib: Fix out-of-bounds read from hash
table entries created by dtdCopy in expat/lib/xmlparse.c,
expat/tests/basic_tests.c.
- CVE-2026-76641
* SECURITY UPDATE: hash flooding vulnerability (possibly causing denial of
service)
- debian/patches/CVE-2026-76956.patch: lib: Fix inverted getentropy() return
in writeRandomBytes_getentropy in expat/lib/random_getentropy.c.
- CVE-2026-76956
* SECURITY UPDATE: use after free
- debian/patches/CVE-2026-76957-1.patch: Protect custom encoding callbacks
from parser reentry in expat/lib/xmlparse.c.
- debian/patches/CVE-2026-76957-2.patch: Test custom encoding callback
reentry protection in expat/tests/misc_tests.c.
- CVE-2026-76957
-- Isabel Garcia Contreras <[email protected]> Mon, 21 Sep
2026 15:29:35 -0400
** Affects: expat (Ubuntu)
Importance: Wishlist
Status: New
** Tags: dcr-merge
** Changed in: expat (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: expat (Ubuntu)
Milestone: None => ubuntu-26.11
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171207
Title:
Merge expat 2.9.0-1 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/expat/+bug/2171207/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
