This bug was fixed in the package expat - 2.9.0-1
---------------
expat (2.9.0-1) unstable; urgency=high
* New upstream release:
- fixes CVE-2026-77214: validate parameter len against available buffer
capacity in XML_ParseBuffer(),
- fixes CVE-2026-102633: integer overflow in function expat_realloc()
on 32bit platforms.
* Update libexpat1 symbols.
-- Laszlo Boszormenyi (GCS) <[email protected]> Mon, 05 Oct 2026 22:04:46
+0200
expat (2.8.5-2) unstable; urgency=high
* Backport upstream fixes for CVE-2026-102633: replace assert with runtime
overflow check in expat_realloc (closes: #1149507).
-- Laszlo Boszormenyi (GCS) <[email protected]> Wed, 30 Sep 2026 16:38:52
+0200
expat (2.8.5-1) unstable; urgency=medium
* New upstream release.
-- Laszlo Boszormenyi (GCS) <[email protected]> Sun, 27 Sep 2026 08:45:04
+0200
expat (2.8.4-2) unstable; urgency=high
* Backport upstream fixes for CVE-2026-93990: fails to validate low
surrogates following high surrogates in UTF-16 input (closes: #1148665).
-- Laszlo Boszormenyi (GCS) <[email protected]> Tue, 22 Sep 2026 06:48:48
+0200
expat (2.8.4-1) unstable; urgency=high
* New upstream release:
- fixes CVE-2026-66046 and CVE-2026-76641: fix quadratic runtime from
"attribute isCdata lookups" that allowed denial of service attacks,
- fixes CVE-2026-76957: protect custom encoding callbacks from parser
re-entry,
- fixes CVE-2026-76956: fix inverted getentropy() return handling.
-- Laszlo Boszormenyi (GCS) <[email protected]> Mon, 31 Aug 2026 18:48:23
+0200
** Changed in: expat (Ubuntu)
Status: New => Fix Released
** CVE added: https://cve.org/CVERecord?id=CVE-2026-102633
** CVE added: https://cve.org/CVERecord?id=CVE-2026-66046
** CVE added: https://cve.org/CVERecord?id=CVE-2026-76641
** CVE added: https://cve.org/CVERecord?id=CVE-2026-76956
** CVE added: https://cve.org/CVERecord?id=CVE-2026-76957
** CVE added: https://cve.org/CVERecord?id=CVE-2026-77214
** CVE added: https://cve.org/CVERecord?id=CVE-2026-93990
** Changed in: expat (Ubuntu)
Assignee: Benjamin Drung (bdrung) => (unassigned)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171207
Title:
Merge expat 2.9.0-1 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/expat/+bug/2171207/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
