UbuntuUpdates.org

Package "libexpat1"

Name: libexpat1

Description:

XML parsing C library - runtime library
Latest version: 2.6.1-2ubuntu0.6
Release: noble (24.04)
Level: updates
Repository: main
Head package: expat
Homepage: https://libexpat.github.io/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libexpat1"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libexpat1" in Noble

Repository Area Version
base main 2.6.1-2build1
security main 2.6.1-2ubuntu0.6

Changelog

Version: 2.6.1-2ubuntu0.6 2026-09-24 18:07:26 UTC

expat (2.6.1-2ubuntu0.6) noble-security; urgency=medium

  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56410-1.patch: xmlwf: protect resolveSystemId from
      integer overflow in expat/xmlwf/xmlfile.c.
    - debian/patches/CVE-2026-56410-2.patch: xmlwf: guard each operator in
      resolveSystemId length sum in expat/xmlwf/xmlfile.c.
    - CVE-2026-56410
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56406.patch: lib: Copy overflow check from
      `XML_Parse` to `XML_ParseBuffer` in expat/lib/xmlparse.c.
    - CVE-2026-56406
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56409.patch: xmlwf: protect output path join from
      integer overflow in expat/xmlwf/xmlwf.c.
    - CVE-2026-56409
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56407.patch: cap entity textLen against signed
      integer overflow in expat/lib/xmlparse.c.
    - CVE-2026-56407
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56411.patch: xmlwf: protect notation list
      allocation from integer overflow in expat/xmlwf/xmlwf.c.
    - CVE-2026-56411
  * SECURITY UPDATE: use after free
    - debian/patches/CVE-2026-56131.patch: lib: protect XML_ResumeParser from
      being called from a handler in expat/lib/xmlparse.c,
      expat/tests/handlers.c, expat/tests/handlers.h, expat/tests/misc_tests.c.
    - CVE-2026-56131
  * SECURITY UPDATE: heap-based buffer overflow
    - debian/patches/CVE-2026-56132-pre1.patch: lib: swap '(size_t)(-1)' for C99
      equivalent, 'SIZE_MAX' in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-pre2.patch: lib: use a `size_t` for group
      sizes in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-1.patch: lib: Remove reuse of `m_groupSize`
      to count `m_scaffIndex` allocation in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-2.patch: lib: doProlog: Fix out-of-bound
      scaffolding index store in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-3.patch: tests: Add a test case for
      scaffolding array limits in shared DTDs in expat/tests/basic_tests.c.
    - debian/patches/CVE-2026-56132-4.patch: lib: Remove unnecessary
      `scaffIndex` expansion in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-5.patch: lib: Remove indented scoping of
      `new_connector` local in expat/lib/xmlparse.c.
    - CVE-2026-56132
  * SECURITY UPDATE: out-of-bounds read
    - debian/patches/CVE-2026-72522-1.patch: lib: Improve in-code comment for
      functions *toUtf16 in expat/lib/xmltok.c.
    - debian/patches/CVE-2026-72522-2.patch: lib: Stop functions *_toUtf16 from
      mis-classifying low surrogates as high surrogates in expat/lib/xmltok.c.
    - debian/patches/CVE-2026-72522-3.patch: tests/misc_tests.c: Cover Unicode
      surrogate mix-up in expat/tests/misc_tests.c.
    - debian/patches/CVE-2026-72522-4.patch: lib: Make an exit condition in
      `storeAttributeValue` more defensive in expat/lib/xmlparse.c.
    - CVE-2026-72522
  * SECURITY UPDATE: denial of service (algorithmic complexity of storeAtts())
    - debian/patches/CVE-2026-66046.patch: lib: Rename hash table
      `defaultAttsNames` to `defaultAttForName` in expat/lib/xmlparse.c.
    - CVE-2026-66046
  * SECURITY UPDATE: out-of-bounds read
    - debian/patches/CVE-2026-76641.patch: lib: Fix out-of-bounds read from hash
      table entries created by dtdCopy in expat/lib/xmlparse.c,
      expat/tests/basic_tests.c.
    - CVE-2026-76641
  * SECURITY UPDATE: use after free
    - debian/patches/CVE-2026-76957-1.patch: Protect custom encoding callbacks
      from parser reentry in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-76957-2.patch: Test custom encoding callback
      reentry protection in expat/tests/misc_tests.c.
    - CVE-2026-76957

 -- Isabel Garcia Contreras Mon, 21 Sep 2026 16:05:43 -0400
Source diff to previous version
CVE-2026-56410 xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56406 libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
CVE-2026-56409 xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
CVE-2026-56407 libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
CVE-2026-56411 xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-56131 libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a us
CVE-2026-56132 In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled w
CVE-2026-72522 libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Uni
CVE-2026-66046 Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c,
CVE-2026-76641 Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external e
CVE-2026-76957 libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CV

Version: 2.6.1-2ubuntu0.5 2026-09-21 19:07:50 UTC

expat (2.6.1-2ubuntu0.5) noble-security; urgency=medium

  * SECURITY UPDATE: large dynamic memory allocations via a small document
    - debian/patches/CVE-2025-59375-1.patch: lib: Make function dtdCreate use
      macro MALLOC in expat/lib/xmlparse.c.
    - debian/patches/CVE-2025-59375-2.patch: lib: Make string pools use macros
      MALLOC, FREE, REALLOC in expat/lib/xmlparse.c.
    - debian/patches/CVE-2025-59375-3.patch: lib: Make function hash tables use
      macros MALLOC and FREE in expat/lib/xmlparse.c.
    - debian/patches/CVE-2025-59375-4.patch: lib: Make function copyString use
      macro MALLOC in expat/lib/xmlparse.c.
    - debian/patches/CVE-2025-59375-5.patch: lib: Make function dtdReset use
      macro FREE in expat/lib/xmlparse.c.
    - debian/patches/CVE-2025-59375-6.patch: lib: Make function dtdDestroy use
      macro FREE in expat/lib/xmlparse.c.
    - debian/patches/CVE-2025-59375-7.patch: lib: Make function dtdCopy use
      macro MALLOC in expat/lib/xmlparse.c.
    - debian/patches/CVE-2025-59375-8.patch: lib: Implement tracking of dynamic
      memory allocations in .github/workflows/data/exported-symbols.txt,
      expat/lib/expat.h, expat/lib/internal.h, expat/lib/libexpat.def.cmake,
      expat/lib/xmlparse.c, expat/tests/basic_tests.c,
      expat/tests/nsalloc_tests.c, expat/xmlwf/xmlwf.c,
      expat/xmlwf/xmlwf_helpgen.py.
    - debian/patches/CVE-2025-59375-9.patch: lib: Make XML_MemFree and
      XML_FreeContentModel match their siblings in expat/lib/xmlparse.c.
    - debian/patches/CVE-2025-59375-10.patch: lib: Exclude XML_Mem* functions
      from allocation tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2025-59375-11.patch: lib: Exclude the main input buffer
      from allocation tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2025-59375-12.patch: lib: Exclude the content model
      from allocation tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2025-59375-13.patch: tests: Cover allocation tracking
      and limiting with tests in expat/lib/internal.h, expat/lib/xmlparse.c,
      expat/tests/alloc_tests.c.
    - debian/patches/CVE-2025-59375-14.patch: xmlwf: Wire allocation tracker
      config to existing arguments -a and -b in expat/doc/xmlwf.xml,
      expat/xmlwf/xmlwf.c, expat/xmlwf/xmlwf_helpgen.py.
    - debian/patches/CVE-2025-59375-15.patch: fuzz: Be robust towards NULL
      return from XML_ExternalEntityParserCreate in
      expat/fuzz/xml_parse_fuzzer.c, expat/fuzz/xml_parsebuffer_fuzzer.c.
    - debian/patches/CVE-2025-59375-16.patch: lib: Document and regression-proof
      absence of integer overflow from expat_realloc in expat/lib/xmlparse.c.
    - debian/patches/CVE-2025-59375-17.patch: lib: Fix alignment of internal
      allocations for some non-amd64 architectures in expat/lib/internal.h,
      expat/lib/xmlparse.c, expat/tests/alloc_tests.c.
    - debian/patches/CVE-2025-59375-18.patch: tests: Fix test guard for test
      related to allocation tracking in expat/tests/alloc_tests.c.
    - debian/patches/CVE-2025-59375-19.patch: tests: Add new test
      test_alloc_tracker_pointer_alignment in expat/tests/alloc_tests.c.
    - debian/patches/CVE-2025-59375-20.patch: lib: Fix detection of asynchronous
      tags in entities in expat/lib/xmlparse.c.
    - debian/patches/CVE-2025-59375-21.patch: tests: Cover
      XML_ERROR_ASYNC_ENTITY cases in expat/tests/misc_tests.c.
    - debian/patches/CVE-2025-59375-22.patch: tests: Add line/column checks to
      async entity tests in expat/tests/misc_tests.c.
    - CVE-2025-59375
  * SECURITY UPDATE: NULL function-pointer dereference
    - debian/patches/CVE-2026-32776.patch: Fix NULL function-pointer dereference
      for empty external parameter entities in expat/lib/xmlparse.c,
      expat/tests/basic_tests.c.
    - CVE-2026-32776
  * SECURITY UPDATE: infinite loop while parsing DTD content
    - debian/patches/CVE-2026-32777-1.patch: lib: Reject XML_TOK_INSTANCE_START
      infinite loop in entityValueProcessor in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-32777-2.patch: misc_tests.c: Cover
      XML_TOK_INSTANCE_START infinite loop case in expat/tests/misc_tests.c.
    - CVE-2026-32777
  * SECURITY UPDATE: NULL pointer dereference
    - debian/patches/CVE-2026-32778-1.patch: copy prefix name to pool before
      lookup in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-32778-2.patch: test that we do not end up with a
      zombie PREFIX in the pool in expat/tests/nsalloc_tests.c.
    - CVE-2026-32778
  * SECURITY UPDATE: denial of service via moderately sized crafted XML input
    - debian/patches/CVE-2026-45186-1.patch: Make
      "counting_start_element_handler" count default attrs in
      expat/tests/basic_tests.c, expat/tests/handlers.c, expat/tests/handlers.h.
    - debian/patches/CVE-2026-45186-2.patch: test(attlist): Cover duplicate
      attribute names in expat/tests/basic_tests.c.
    - debian/patches/CVE-2026-45186-3-pre.patch: tests: Migrate test_attributes
      off of g_parser in expat/tests/basic_tests.c.
    - debian/patches/CVE-2026-45186-3.patch: tests: Define .attributes the first
      time around in expat/tests/basic_tests.c.
    - debian/patches/CVE-2026-45186-4.patch: tests: Make
      counting_start_element_handler enforce complete attribute lists in
      expat/tests/handlers.c.
    - debian/patches/CVE-2026-45186-5.patch: lib: Extract a constant for
      upcoming reuse in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-45186-6.patch: lib: Introduce
      ELEMENT_TYPE.defaultAttsNames in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-45186-7.patch: lib: Leverage
      ELEMENT_TYPE.defaultAttsNames for attribute collision detection in
      expat/lib/xmlparse.c.
    - CVE-2026-45186
  * SECURITY UPDATE: hash flooding caused by insufficient entropy
    - debian/patches/CVE-2026-41080-1-pre.patch: lib/xmlparse.c: Address clang-
      tidy warning misc-no-recursion in expat/lib/xmlparse.c.
    - debian/patc
Source diff to previous version
CVE-2025-59375 libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
CVE-2026-32776 libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32777 libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32778 libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2026-45186 In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML
CVE-2026-41080 libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVE-2026-56408 libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56403 libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-50219 libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset fr
CVE-2026-56412 libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within
CVE-2026-56404 libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56405 libexpat before 2.8.2 has an integer overflow in getAttributeId.

Version: 2.6.1-2ubuntu0.4 2026-02-16 11:07:40 UTC

  expat (2.6.1-2ubuntu0.4) noble-security; urgency=medium

  * SECURITY UPDATE: NULL pointer dereference
    - debian/patches/CVE-2026-24515.patch: updates
      XML_ExternalEntityParserCreate to copy unknown encoding handler user
      data in expat/lib/xmlparse.c.
    - CVE-2026-24515
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-25210*.patch: adds an integer overflow check for
      tag buffer reallocation in the doContent function of
      expat/lib/xmlparse.c.
    - CVE-2026-25210

 -- Ian Constantin <email address hidden> Wed, 04 Feb 2026 17:24:08 +0200
Source diff to previous version
CVE-2026-24515 In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
CVE-2026-25210 In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for t

Version: 2.6.1-2ubuntu0.3 2025-04-08 13:07:56 UTC

  expat (2.6.1-2ubuntu0.3) noble-security; urgency=medium

  * SECURITY UPDATE: denial of service via stack overflow
    - debian/patches/CVE-2024-8176-pre.patch: Remove XML_DTD guards
      before is_param accesses
    - debian/patches/CVE-2024-8176-test-pre.patch: tests - Stop
      counting_start_element_handler from using g_parser
    - debian/patches/CVE-2024-8176-1.patch: Resolve the recursion during
      entity processing to prevent stack overflow
    - debian/patches/CVE-2024-8176-2.patch: Stop updating event pointer
      on exit for reentry
    - CVE-2024-8176

 -- Vyom Yadav <email address hidden> Fri, 28 Mar 2025 12:36:29 +0530
Source diff to previous version
CVE-2024-8176 A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an

Version: 2.6.1-2ubuntu0.2 2024-12-10 02:06:55 UTC

  expat (2.6.1-2ubuntu0.2) noble-security; urgency=medium

  * SECURITY UPDATE: denial-of-service via XML_ResumeParser
    - debian/patches/CVE-2024-50602-1.patch: Make function XML_StopParser of
      expat/lib/xmlparse.c refuse to stop/suspend an unstarted parser
    - debian/patches/CVE-2024-50602-2.patch: Add XML_PARSING case to parser
      state in function XML_StopParser of expat/lib/xmlparse.c
    - debian/patches/CVE-2024-50602-3.patch: Add tests for CVE-2024-50602 to
      expat/tests/misc_tests.c
    - CVE-2024-50602

 -- Nicolas Campuzano Jimenez <email address hidden> Sun, 01 Dec 2024 15:52:41 -0500
CVE-2024-50602 An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an un


About   -   Send Feedback to @ubuntu_updates