-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 18:48:23 +0200
Source: expat
Architecture: source
Version: 2.8.4-1
Distribution: unstable
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changes:
expat (2.8.4-1) unstable; urgency=high
.
* New upstream release:
- fixes CVE-2026-66046 and CVE-2026-76641: fix quadratic runtime from
"attribute isCdata lookups" that allowed denial of service attacks,
- fixes CVE-2026-76957: protect custom encoding callbacks from parser
re-entry,
- fixes CVE-2026-76956: fix inverted getentropy() return handling.
Checksums-Sha1:
5df941ee1d9b2b785bc82938107be87477de7594 1970 expat_2.8.4-1.dsc
e817e580d1b678f934f5c4659be47b636ed9a644 8468126 expat_2.8.4.orig.tar.gz
e3a08ce5d7f458009e8482b0f9776853aec1f9aa 14136 expat_2.8.4-1.debian.tar.xz
Checksums-Sha256:
b3dc30ff68a32b95746899d2c8e03cfbb5350b982916d649fab179e56ef5ed3e 1970 expat_2.8.4-1.dsc
a8a9c5cbba9110000b13cc9943f50fcd7e552a5cbad49cb191142c500a0a11b7 8468126 expat_2.8.4.orig.tar.gz
a90e0731e6ccdee5f4368a69ab12cf8cc9f5f29e7e61959e2e839d4ca00361fc 14136 expat_2.8.4-1.debian.tar.xz
Files:
123aa714a376cd290d1b288448627962 1970 text optional expat_2.8.4-1.dsc
4a939ad27225c2eeed2fb6fef79eed5c 8468126 text optional expat_2.8.4.orig.tar.gz
3740985eb400e402ec097334d574be4f 14136 text optional expat_2.8.4-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAmqVs2gACgkQ3OMQ54ZM
yL+IPg//WuF4f68D2wd+zgZshZ5P/AYGz9sVa11ZhzJvJbaGYTlcudTNYtKrkhW/
haum7E6W6L3IpLNFf4siRJ4wiYigaZexpl5SKrrICw8ZG93FQKhRtBIrbu/2BIdD
qA0899Tdb7GLU3wgZlY78189btT6djFEMnujeHSoRwjp8DRNlKMf5N4bG3k6om98
PXA0yb5PgjJfCL3M/4yjpSOaqQASqZGYQtrU5iDkx1L4cPOvUxSECBnjVIvU6eOv
fGelSfTGr2TpFEEdAU5r6xcB/DDEKs0zgoGoIPYm80OXiWo40ZszfYbDLTP6HWwP
qpp/pClM8hfDnvJabY6vGKyrNejpicBXx5ToS9aIvlTvGVFtLn3jYlMRTzEKzpJt
6jeU84x/IJzYpjepLvr3bvOFmx8lNM9VGq+oAZaA0YJafbOlbNkDxgSS/kkEo9LS
oqyBAFvgelHvFfiyf0vE/vMSlxXhSCrdbGlz61vhHmIpQEwivp8D7/XxUGlG7j0o
IRJ3zGdVfuQdocvA/TLbtVpylwTQkbPC+m75bf4xmZ9Ff4iK3gjhoZ8buiG5kM+o
6Cno5YZAMVb8W8S7HfAeiAeyUfjF3PLYl5h2pDgblygA298d4VUE60Pp+m5XH1Kr
Oetsgpk8karviCWVNZ04iBf6H2tu7wdeAetmMvJp/yNs2AV8EIQ=
=ynp0
-----END PGP SIGNATURE-----
