-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 22 Oct 2026 00:34:41 +0200
Source: expat
Architecture: source
Version: 2.5.0-1+deb12u5
Distribution: bookworm-security
Urgency: medium
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Andrej Shadura <andrewsh@debian.org>
Changes:
expat (2.5.0-1+deb12u5) bookworm-security; urgency=medium
.
* Backport upstream security patches:
- CVE-2026-56132: Fix out-of-bound scaffolding index store in doProlog.
- CVE-2026-102633: Add runtime overflow check in expat_realloc.
- CVE-2026-77214: Fix a heap buffer over-read vulnerability in
XML_ParseBuffer.
* Set XML_GE=1 to enable allocation tracking (CVE-2025-59375).
Checksums-Sha1:
e8f84b8dce2129f2ed6586099c36731d6edd3fca 1427 expat_2.5.0-1+deb12u5.dsc
51d2aae97c8694700c1a578a3218d83890e55f1e 67940 expat_2.5.0-1+deb12u5.debian.tar.xz
4c7d3b11238b26d06f94613b6f70bcfeffc4c3aa 4740 expat_2.5.0-1+deb12u5_source.buildinfo
Checksums-Sha256:
ef1c606d8e386052d3aea9b3b5ec43f3902107c007150960521781aa59ab1247 1427 expat_2.5.0-1+deb12u5.dsc
08bda5605c940a2068a8f5df2a798524d8f403eae6d01e4f7039074a8e244d9e 67940 expat_2.5.0-1+deb12u5.debian.tar.xz
278d9597bc340bca98475626171d58c9dc6a2c4d4c6e654629d566aba08e8eae 4740 expat_2.5.0-1+deb12u5_source.buildinfo
Files:
036316a61800c64ebe46b9003a9103cd 1427 text optional expat_2.5.0-1+deb12u5.dsc
727c98df1219a4cfb33a64a8152fae89 67940 text optional expat_2.5.0-1+deb12u5.debian.tar.xz
bc9d32150120510b3ea934dc0cb6ee72 4740 text optional expat_2.5.0-1+deb12u5_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQSD3NF/RLIsyDZW7aHoRGtKyMdyYQUCatm0+AAKCRDoRGtKyMdy
YRetAP0fuvuAVjThbUf3d8BvR+/TBYomEJUQBubTYjnpwBI2MQD/ShD4lwqyN/Na
YWGnrvV+iy5J2xuCypcGM2pHcItCxA4=
=n/Gn
-----END PGP SIGNATURE-----
