Guilhem Moulin pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b59097f7 by Guilhem Moulin at 2025-11-08T12:41:20+01:00
Refine triaging for CVE-2025-59375/expat
The upstream fix reuses the existing protection (amplification limits)
against billion laughs attacks (CVE-2013-0340) and applies it to
allocations of dynamic memory.
It is particularly intrusive to backport to versions before 2.4.0 which
lack the amplification limit API functions and associated logic.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -20693,7 +20693,7 @@ CVE-2025-59375 (libexpat in Expat before 2.7.2 allows
attackers to trigger large
- expat 2.7.2-1 (bug #1115298)
[trixie] - expat <no-dsa> (Minor issue)
[bookworm] - expat <ignored> (Minor issue)
- [bullseye] - expat <ignored> (Minor issue)
+ [bullseye] - expat <ignored> (Minor issue, too intrusive to backport)
NOTE: https://github.com/libexpat/libexpat/issues/1018
NOTE: https://github.com/libexpat/libexpat/pull/1034
NOTE: Fixed by:
https://github.com/libexpat/libexpat/commit/0872c189db6e457084fca335662a9cb49e8ec4c7
(R_2_7_2)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b59097f74e77f1774d827b2f8e8627404b9bf59d
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b59097f74e77f1774d827b2f8e8627404b9bf59d
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
