UbuntuUpdates.org

Package "expat"

Name: expat

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • XML parsing C library - runtime library
  • XML parsing C library - development kit
Latest version: 2.7.1-2ubuntu0.2
Release: questing (25.10)
Level: updates
Repository: main

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "expat" in Questing

Repository Area Version
base main 2.7.1-2
base universe 2.7.1-2
security universe 2.7.1-2ubuntu0.2
security main 2.7.1-2ubuntu0.2
updates universe 2.7.1-2ubuntu0.2

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2.7.1-2ubuntu0.2 2026-02-11 09:08:10 UTC

  expat (2.7.1-2ubuntu0.2) questing-security; urgency=medium

  * SECURITY UPDATE: Large memory allocation.
    - debian/patches/CVE-2025-59375-*: Fix large memory allocation in
      expat/lib/xmlparse.c, expat/lib/expat.h, expat/tests/basic_tests.c,
      expat/tests/nsalloc_tests.c, expat/xmlwf/xmlwf.c,
      expat/xmlwf/xmlwf_helpgen.py, expat/lib/internal.h,
      expat/tests/alloc_tests.c, expat/fuzz/xml_lpm_fuzzer.cpp,
      expat/fuzz/xml_parse_fuzzer.c, expat/tests/misc_tests.c.
    - debian/libexpat1.symbols: Add new symbols.
    - CVE-2025-59375
  * SECURITY UPDATE: Null pointer dereference.
    - debian/patches/CVE-2026-24515-*: Add oldUnknownEncodingHandlerData and
      assignments in expat/lib/xmlparse.c. Add tests in
      expat/tests/basic_tests.c.
    - CVE-2026-24515
  * SECURITY UPDATE: Integer overflow.
    - debian/patches/CVE-2026-25210-*: Change bufSize operation and assignment
      and add error check in expat/lib/xmlparse.c.
    - CVE-2026-25210

 -- Hlib Korzhynskyy <email address hidden> Fri, 06 Feb 2026 11:45:02 -0330
CVE-2025-59375 libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
CVE-2026-24515 In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
CVE-2026-25210 In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for t


About   -   Send Feedback to @ubuntu_updates