On Thu, Feb 08, 2024 at 09:20:14PM +0100, Christian Melki wrote: > https://github.com/libexpat/libexpat/blob/R_2_6_0/expat/Changes > > Plugs CVEs: > CVE-2023-52425 - Fix quadratic runtime issues with big tokens > CVE-2023-52426 - Fix billion laughs attacks without XML_DTD >
I did the same update (just without the nice commit message) and pushed it to master before I saw your patch. Michael > Signed-off-by: Christian Melki <[email protected]> > --- > rules/expat.make | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/rules/expat.make b/rules/expat.make > index d12144458..418496b14 100644 > --- a/rules/expat.make > +++ b/rules/expat.make > @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_EXPAT) += expat > # > # Paths and names > # > -EXPAT_VERSION := 2.5.0 > -EXPAT_MD5 := 5e9974d422dc4b157f300568ad28ebf6 > +EXPAT_VERSION := 2.6.0 > +EXPAT_MD5 := eeb1cf76f51dadebff73fe6aa317ba37 > EXPAT := expat-$(EXPAT_VERSION) > EXPAT_SUFFIX := tar.bz2 > EXPAT_RELEASE := R_$(subst .,_,$(EXPAT_VERSION)) > -- > 2.34.1 > > > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
