Your message dated Wed, 30 Sep 2026 15:04:53 +0000
with message-id <[email protected]>
and subject line Bug#1149507: fixed in expat 2.8.5-2
has caused the Debian Bug report #1149507,
regarding expat: CVE-2026-102633
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149507: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149507
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: expat
Version: 2.8.5-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/libexpat/libexpat/pull/1392
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for expat.
CVE-2026-102633[0]:
| libexpat versions 2.7.2 through 2.8.5 contain an integer overflow
| vulnerability in expat_realloc() function on 32-bit platforms when
| computing allocation sizes. Attackers supplying malicious XML to
| applications parsing with vulnerable libexpat can cause heap buffer
| overflow, memory corruption, or denial of service.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-102633
https://www.cve.org/CVERecord?id=CVE-2026-102633
[1] https://github.com/libexpat/libexpat/pull/1392
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: expat
Source-Version: 2.8.5-2
Done: Laszlo Boszormenyi (GCS) <[email protected]>
We believe that the bug you reported is fixed in the latest version of
expat, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <[email protected]> (supplier of updated expat package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 30 Sep 2026 16:38:52 +0200
Source: expat
Architecture: source
Version: 2.8.5-2
Distribution: unstable
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <[email protected]>
Changed-By: Laszlo Boszormenyi (GCS) <[email protected]>
Closes: 1149507
Changes:
expat (2.8.5-2) unstable; urgency=high
.
* Backport upstream fixes for CVE-2026-102633: replace assert with runtime
overflow check in expat_realloc (closes: #1149507).
Checksums-Sha1:
b8759af9dc461ea300df57779c9a8863caa2edca 1970 expat_2.8.5-2.dsc
45bf4a9a1b04743425c7d83fac61747905e0305f 15168 expat_2.8.5-2.debian.tar.xz
Checksums-Sha256:
1093b599a1245827eca68383371a3b3a1991fd3c7f9537506e4e557a3c0523d4 1970
expat_2.8.5-2.dsc
1c4354bc84ba14b4269e72e41192655c1d0df48a661c6362d4349e0133ee67a5 15168
expat_2.8.5-2.debian.tar.xz
Files:
b37f4f5c55fc5bc9b60361b097c68e46 1970 text optional expat_2.8.5-2.dsc
73b388d08f40e4909673d55ed1af038d 15168 text optional
expat_2.8.5-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAmq9IjAACgkQ3OMQ54ZM
yL+/yw//ddf79Ga86AIJV+JDM5h8vbvbFJViAItvrIsNFOHphejtJUySzDPAJvGu
du+QcM1nyrC3hh8n0BY05bk87DZbVC2zuF0GQWwx0ADbjkElQ758Z0VrgcWUr4Ov
9VmY3txnGzGbT52drsrF6k9eIM0gMIGBA9GWZH9coxKiNfEALGhdEXXNgrGUJ2PU
BbUWwKHNGtxdpGoc8bxO1gYw9CsGws6yCSi70dh3/qtj6Nv9ZfRFBg2u9L9PYpan
3f6KmQUqgvNw+oRInK6EFDmZjQV9YPPBwmsC/eKNbRQhmzJ+9Nirg1fCmAHOOTd2
cRpxp0kJZpMuAZ4PkeM64rOihxohQJrQ/1h3RnwwkJ/IABxmp0OH00JmKZA2wA2F
wHCQaXsWjd/zcYnFpce1fsqCzPLMWKi8L563heJSnXEvu/IKVjeEqQy8AWc/MD9C
Xixf1r/rD0acjKC0eNkqfKdJ6wd3l2b13re69PR33qlzCHGh71WsSclgbQNFTqMK
yMpMMiRizSnDZkh/PuxeS5fgWpTmBiTI7944QNMD3gaIokfyUvama7P+OKzqXrJC
qeQoYirtn1s5Ezj/JWeGVWyzaSli6mQdhCvrmQqooQIbf3xB/pA5fNdKU1EzlYeN
cgQ9OlSl3+4p+SaCEY4jxUKbMGYTf/mkfMA3N5eyE4ji/SMSGE4=
=3rMz
-----END PGP SIGNATURE-----
pgpqtCtl7WxNF.pgp
Description: PGP signature
--- End Message ---
