Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
3d359c69 by Salvatore Bonaccorso at 2025-11-08T10:22:42+01:00
Update status for CVE-2025-59375/expat
trixie is marked as no-dsa a future update targeting trixie aims to
rebase to 2.7.3 release (and to be proposed via trixie-pu).
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -20691,6 +20691,8 @@ CVE-2025-59378 (In guix-daemon in GNU Guix before
1618ca7, a content-addressed-m
NOTE: Fixed by:
https://codeberg.org/guix/guix/commit/9202921e812708b23788b2209cdb576d456f56db
CVE-2025-59375 (libexpat in Expat before 2.7.2 allows attackers to trigger
large dynam ...)
- expat 2.7.2-1 (bug #1115298)
+ [trixie] - expat <no-dsa> (Minor issue)
+ [bookworm] - expat <ignored> (Minor issue)
NOTE: https://github.com/libexpat/libexpat/issues/1018
NOTE: https://github.com/libexpat/libexpat/pull/1034
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/0872c189db6e457084fca335662a9cb49e8ec4c7
(R_2_7_2)
@@ -20714,6 +20716,8 @@ CVE-2025-59375 (libexpat in Expat before 2.7.2 allows
attackers to trigger large
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/a21a3a8299e1ee0b0ae5ae2886a0746d088cf135
(R_2_7_2)
NOTE: https://www.openwall.com/lists/oss-security/2025/09/24/11
NOTE: Follow-up: https://github.com/libexpat/libexpat/pull/1048
(R_2_7_3)
+ NOTE: Not a vulnerability per se, but rather a hardening and
continuation of
+ NOTE: the billion laughs attack feature work (cf. CVE-2013-0340)
CVE-2025-59364 (The express-xss-sanitizer (aka Express XSS Sanitizer) package
through ...)
NOT-FOR-US: Node express-xss-sanitizer
CVE-2025-41713 (During a short time frame while the device is booting an
unauthenticat ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3d359c69864f2aa8785622891518dfbbf9707dc6
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3d359c69864f2aa8785622891518dfbbf9707dc6
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
