Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package expat for openSUSE:Factory checked in at 2026-10-10 14:55:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/expat (Old) and /work/SRC/openSUSE:Factory/.expat.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "expat" Sat Oct 10 14:55:18 2026 rev:90 rq:1383718 version:2.9.0 Changes: -------- --- /work/SRC/openSUSE:Factory/expat/expat.changes 2026-10-03 20:13:23.678253362 +0200 +++ /work/SRC/openSUSE:Factory/.expat.new.3698736/expat.changes 2026-10-10 14:55:21.145873648 +0200 @@ -1,0 +2,17 @@ +Tue Oct 6 13:29:56 UTC 2026 - David Anes <[email protected]> + +- update to 2.9.0: + * Security fixes: + * CVE-2026-102633, bsc#1283493: integer overflow in expat_realloc + on 32bit platforms + * CVE-2026-77214, bsc#1284334: out-of-bounds read in + XML_ParseBuffer due to missing validation of the len parameter + * drop the patch, fixed upstream: + * expat-CVE-2026-102633.patch + * Bug fixes: + * Handle OOM when copying encodingName in XML_ParserReset + * New features: + * Properties API to get and set scalar properties of a parser + * Five new 64bit location API functions + +------------------------------------------------------------------- @@ -63 +80 @@ - bsc#1275096, CVE-2026-56403, CVE-2026-56404, CVE-2026-56405, + bsc#1275115, CVE-2026-56403, CVE-2026-56404, CVE-2026-56405, @@ -303 +320 @@ - - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with + - CVE-2024-45490, bsc#1229930, bsc#1229962 -- Calling function XML_ParseBuffer with @@ -312 +329 @@ - - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an + - CVE-2024-45491, bsc#1229931, bsc#1229963 -- Internal function dtdCopy can have an @@ -317 +334 @@ - - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can + - CVE-2024-45492, bsc#1229932, bsc#1229964 -- Internal function nextScaffoldPart can Old: ---- expat-2.8.5.tar.xz expat-2.8.5.tar.xz.asc expat-CVE-2026-102633.patch New: ---- expat-2.9.0.tar.xz expat-2.9.0.tar.xz.asc ----------(Old B)---------- Old: * drop the patch, fixed upstream: * expat-CVE-2026-102633.patch * Bug fixes: ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ expat.spec ++++++ --- /var/tmp/diff_new_pack.2hXALT/_old 2026-10-10 14:55:22.030910651 +0200 +++ /var/tmp/diff_new_pack.2hXALT/_new 2026-10-10 14:55:22.032910734 +0200 @@ -17,10 +17,10 @@ # -%global unversion 2_8_5 +%global unversion 2_9_0 %define sover 1 Name: expat -Version: 2.8.5 +Version: 2.9.0 Release: 0 Summary: XML Parser Toolkit License: MIT @@ -33,8 +33,6 @@ # https://www.gentoo.org/inside-gentoo/developers/index.html#sping # https://github.com/libexpat/libexpat/issues/537#issuecomment-1003796884 Source4: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x3176ef7db2367f1fca4f306b1f9b0e909af37285#/expat.keyring -# CVE-2026-102633 [bsc#1283493], denial of service via integer overflow in expat_realloc -Patch0: expat-CVE-2026-102633.patch BuildRequires: c++_compiler BuildRequires: pkgconfig ++++++ expat-2.8.5.tar.xz -> expat-2.9.0.tar.xz ++++++ ++++ 6641 lines of diff (skipped)
