Your message dated Sat, 17 Oct 2026 14:32:47 +0000
with message-id <[email protected]>
and subject line Bug#1149507: fixed in expat 2.9.0-1~deb13u1
has caused the Debian Bug report #1149507,
regarding expat: CVE-2026-102633
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149507: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149507
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: expat
Version: 2.8.5-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/libexpat/libexpat/pull/1392
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for expat.
CVE-2026-102633[0]:
| libexpat versions 2.7.2 through 2.8.5 contain an integer overflow
| vulnerability in expat_realloc() function on 32-bit platforms when
| computing allocation sizes. Attackers supplying malicious XML to
| applications parsing with vulnerable libexpat can cause heap buffer
| overflow, memory corruption, or denial of service.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-102633
https://www.cve.org/CVERecord?id=CVE-2026-102633
[1] https://github.com/libexpat/libexpat/pull/1392
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: expat
Source-Version: 2.9.0-1~deb13u1
Done: Salvatore Bonaccorso <[email protected]>
We believe that the bug you reported is fixed in the latest version of
expat, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <[email protected]> (supplier of updated expat package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 11 Oct 2026 15:25:11 +0200
Source: expat
Architecture: source
Version: 2.9.0-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <[email protected]>
Changed-By: Salvatore Bonaccorso <[email protected]>
Closes: 1148665 1149507
Changes:
expat (2.9.0-1~deb13u1) trixie-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* Rebuild for trixie-security
.
expat (2.9.0-1) unstable; urgency=high
.
* New upstream release:
- fixes CVE-2026-77214: validate parameter len against available buffer
capacity in XML_ParseBuffer(),
- fixes CVE-2026-102633: integer overflow in function expat_realloc()
on 32bit platforms.
* Update libexpat1 symbols.
.
expat (2.8.5-2) unstable; urgency=high
.
* Backport upstream fixes for CVE-2026-102633: replace assert with runtime
overflow check in expat_realloc (closes: #1149507).
.
expat (2.8.5-1) unstable; urgency=medium
.
* New upstream release.
.
expat (2.8.4-2) unstable; urgency=high
.
* Backport upstream fixes for CVE-2026-93990: fails to validate low
surrogates following high surrogates in UTF-16 input (closes: #1148665).
.
expat (2.8.4-1) unstable; urgency=high
.
* New upstream release:
- fixes CVE-2026-66046 and CVE-2026-76641: fix quadratic runtime from
"attribute isCdata lookups" that allowed denial of service attacks,
- fixes CVE-2026-76957: protect custom encoding callbacks from parser
re-entry,
- fixes CVE-2026-76956: fix inverted getentropy() return handling.
Checksums-Sha1:
941b0a4b27d13c82ba355981912b42236503bfd0 2157 expat_2.9.0-1~deb13u1.dsc
757c277106dfab05e1ad895d31ed63c82b438c04 8488503 expat_2.9.0.orig.tar.gz
b7fc0d435cc0ca3f0ab63ccd687848e4f6ebcf77 14348
expat_2.9.0-1~deb13u1.debian.tar.xz
1e540318bfeb63b90ed5c2ef5591167e66527f88 5269
expat_2.9.0-1~deb13u1_source.buildinfo
Checksums-Sha256:
09fe168e2186a2672e077d9fda02287b51fa08f73914fcc425b3307b503df8ff 2157
expat_2.9.0-1~deb13u1.dsc
6e8ce7b52ebbaa423c59becc7cf1e6875c42e49228c062ac8123c10e700cec27 8488503
expat_2.9.0.orig.tar.gz
0c1575a3dc3d039f9e6751821efcdfd5246e04c6af4939defa01226d94541fba 14348
expat_2.9.0-1~deb13u1.debian.tar.xz
557af304e95c3ed8a494c4d843397ca4b6afcdfd3e0bb55b322404a4f71f7c02 5269
expat_2.9.0-1~deb13u1_source.buildinfo
Files:
8b93d6a8e28ab8fa25b0df2de5e6f792 2157 text optional expat_2.9.0-1~deb13u1.dsc
a33aef07840ad21397f99299e43b033a 8488503 text optional expat_2.9.0.orig.tar.gz
2f0a17ecfd0a8acbc5a4fd47052b81b3 14348 text optional
expat_2.9.0-1~deb13u1.debian.tar.xz
c2e7798c92da7f5cee94f0e19d52ee90 5269 text optional
expat_2.9.0-1~deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrNTBVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EL1cP/3xzGnnYB6bX2TqTrD4p5nK8QGBr5Xhf
Qdoat7+GnLLYWNKVmfh+EV6kBqd3RpTwbEHYqnh0RW34rvGEGQMZe2douJmD5lG7
NyRa0QNFzU65p0KGLPNWFR9eRBS2mIR5wAAvcroP2lgmBfyo3cd8QzsrEXUUjF3+
2cD2/98qroE4g6CWWD27V/9Y8zOP4t8k7/2QM5er21h5eDiBg/+YKy23gvMfM7xM
0uFbiDfRzhTZsrofjh/02u+ELi4KZVNtFXLKf4D+vqP52D5NNDV5jDXRfT41B3jK
jltuHuYLEXROW/OpZEsbYE9KTAAzi7gdymdj+3KViJbYd7pMimyN84o3nXuy2Fte
JsqEcsDnqWb60EdcE0muUtcqmRtwv1j0gcfvrKfv5/nT73PVrdlcVfEWJxznZXJ1
oLz95AT0NIK/+wBj01IgAGKeI/3dPOnZ00Kt3yz8VWNRfCntJEMf1ONpHBKrgMlu
VoXz41jr88nhEopQPffebdVuSt06/witz/SxFgvatkSG1Oxg+1aEGe2EGdq9t5vz
lHp7yhqNMbwypMr7nhhm/iH6eEjojlzkigbgNED2Lk6GKYk6mY40tC4/4xgFksHm
CwwpGDe8chgSGf7NcfMljv7Nzl4Nk3Cdx1H4eiol3KcTZP+hjE7pcdFHfXuRmiIU
gaPrz5fj/FK/
=HA4W
-----END PGP SIGNATURE-----
pgpM0wCn7Uk8J.pgp
Description: PGP signature
--- End Message ---
