-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 27 Sep 2026 21:38:19 +0200
Source: expat
Architecture: source
Version: 2.5.0-1+deb12u4
Distribution: bookworm-security
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Andrej Shadura <andrewsh@debian.org>
Changes:
expat (2.5.0-1+deb12u4) bookworm-security; urgency=high
.
* Backport upstream security patches.
- CVE-2024-28757: Detect entity expansion (billion laughs) attacks
triggered isolated external parsers
- CVE-2025-59375: Add tracking and limiting of dynamic memory
allocations to bound resource use when parsing a crafted document.
- CVE-2026-24515: Make XML_ExternalEntityParserCreate copy the
unknown encoding handler's user data to the new external parser.
- CVE-2026-25210: Fix doContent's buffer-size calculation to prevent
integer overflow on tag buffer reallocation.
- CVE-2026-32776: Fix NULL function-pointer dereference for empty
external parameter entities
- CVE-2026-32777: Fix an infinite loop while parsing DTD content in
entityValueProcessor.
- CVE-2026-32778: Fix NULL dereference in setContext on retry after OOM.
- CVE-2026-45186: Fix quadratic-complexity attribute default handling
exploitable for a denial of service.
- CVE-2026-66046: Fix a denial of service caused by linear-scan
attribute lookup.
- CVE-2026-93990: Validate low surrogates following high surrogates
when handling UTF-16 input.
Checksums-Sha1:
a316863049259d40dfe11cf0418dec488b554312 1427 expat_2.5.0-1+deb12u4.dsc
fc4536d4cd05ba769d849e77fc0bac47e0db1333 64488 expat_2.5.0-1+deb12u4.debian.tar.xz
c1c8923a6cb31c2bb7051aade7df2318de2bba1c 4740 expat_2.5.0-1+deb12u4_source.buildinfo
Checksums-Sha256:
e1537fb367ee0036f87b3bc2e8f44de9fb042b7c141643aaaa187bca0f25b0e4 1427 expat_2.5.0-1+deb12u4.dsc
f522d550e0a3ff992c293f2c49d44a1248985863d64005f91e086afc5d295908 64488 expat_2.5.0-1+deb12u4.debian.tar.xz
8f354dad56b25e40d65bcd7267924ea25e56d7bff6e26a0b3804d16369e32e4d 4740 expat_2.5.0-1+deb12u4_source.buildinfo
Files:
d3cf4ab4eb867cbabf3a291c5ec8ee8e 1427 text optional expat_2.5.0-1+deb12u4.dsc
b8221f6d4fd2a7b0803898ec9f11d757 64488 text optional expat_2.5.0-1+deb12u4.debian.tar.xz
2783c9e510c7c3e2b4e7633b6e3893d8 4740 text optional expat_2.5.0-1+deb12u4_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQSD3NF/RLIsyDZW7aHoRGtKyMdyYQUCar2GiAAKCRDoRGtKyMdy
YeL7AP4ytM0aOfkoG8QAiZTLxXnHsIC9r4JUr26QDzKdU6g0UgD/Tc3RCaLYhww1
NhJnsjlu/+tjxlyHWRJ0DDUSpQTscAU=
=GDXo
-----END PGP SIGNATURE-----
