UbuntuUpdates.org

Package "expat"

Name: expat

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • XML parsing C library - runtime library
  • XML parsing C library - development kit
Latest version: 2.7.4-1ubuntu0.1
Release: resolute (26.04)
Level: security
Repository: main

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "expat" in Resolute

Repository Area Version
base main 2.7.4-1
base universe 2.7.4-1
security universe 2.7.4-1ubuntu0.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2.7.4-1ubuntu0.1 2026-09-21 15:07:35 UTC

expat (2.7.4-1ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: NULL function-pointer dereference
    - debian/patches/CVE-2026-32776.patch: Fix NULL function-pointer dereference
      for empty external parameter entities in expat/lib/xmlparse.c,
      expat/tests/basic_tests.c.
    - CVE-2026-32776
  * SECURITY UPDATE: infinite loop while parsing DTD content
    - debian/patches/CVE-2026-32777-1.patch: lib: Reject XML_TOK_INSTANCE_START
      infinite loop in entityValueProcessor in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-32777-2.patch: misc_tests.c: Cover
      XML_TOK_INSTANCE_START infinite loop case in expat/tests/misc_tests.c.
    - CVE-2026-32777
  * SECURITY UPDATE: NULL pointer dereference
    - debian/patches/CVE-2026-32778-1.patch: copy prefix name to pool before
      lookup in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-32778-2.patch: test that we do not end up with a
      zombie PREFIX in the pool in expat/tests/nsalloc_tests.c.
    - CVE-2026-32778
  * SECURITY UPDATE: denial of service via moderately sized crafted XML input
    - debian/patches/CVE-2026-45186-1.patch: Make
      "counting_start_element_handler" count default attrs in
      expat/tests/basic_tests.c, expat/tests/handlers.c, expat/tests/handlers.h.
    - debian/patches/CVE-2026-45186-2.patch: test(attlist): Cover duplicate
      attribute names in expat/tests/basic_tests.c.
    - debian/patches/CVE-2026-45186-3.patch: tests: Define .attributes the first
      time around in expat/tests/basic_tests.c.
    - debian/patches/CVE-2026-45186-4.patch: tests: Make
      counting_start_element_handler enforce complete attribute lists in
      expat/tests/handlers.c.
    - debian/patches/CVE-2026-45186-5.patch: lib: Extract a constant for
      upcoming reuse in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-45186-6.patch: lib: Introduce
      ELEMENT_TYPE.defaultAttsNames in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-45186-7.patch: lib: Leverage
      ELEMENT_TYPE.defaultAttsNames for attribute collision detection in
      expat/lib/xmlparse.c.
    - CVE-2026-45186
  * SECURITY UPDATE: hash flooding caused by insufficient entropy
    - debian/patches/CVE-2026-41080-1.patch: lib: Inline function
      `get_hash_secret_salt` in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-2.patch: lib: Drop unused parameter from
      function `generate_hash_secret_salt` in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-3.patch: lib: Migrate hash salt storage to
      larger `struct sipkey` in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-4.patch: lib: Drop unneeded `void *` casts
      in function `generate_hash_secret_salt` in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-5.patch: lib: Extract 16 bytes of entropy
      (instead of 4 to 8) for hash flooding protection in expat/lib/internal.h,
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-6.patch: lib: Introduce internal flag
      `m_hash_secret_salt_set` in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-7.patch: lib: Introduce API function
      `XML_SetHashSalt16Bytes` in expat/lib/expat.h, expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-8.patch: lib: Include `XML_SetHashSalt*`
      with entropy debugging in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-9.patch: tests: Add basic coverage to
      `XML_SetHashSalt16Bytes` in expat/tests/basic_tests.c.
    - debian/patches/CVE-2026-41080-10.patch: doc: Document `XML_SetHashSalt` as
      being deprecated in expat/lib/expat.h, expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-11.patch: cmake|windows: add missing export
      for new XML_SetHashSalt16Bytes in expat/lib/libexpat.def.cmake.
    - CVE-2026-41080
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56408.patch: lib: Waterproof `copyString` from
      integer overflow in expat/lib/xmlparse.c.
    - CVE-2026-56408
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56403-1.patch: lib: Protect function `storeAtts`
      from signed integer overflow in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56403-2.patch: xmlwf: Protect function `xcsdup`
      from signed integer overflow in expat/xmlwf/xmlwf.c.
    - CVE-2026-56403
  * SECURITY UPDATE: use after free
    - debian/patches/CVE-2026-50219-1.patch: lib: Introduce handler call depth
      tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-2.patch: lib: Prepare
      `m_notStandaloneHandler` calls for upcoming wrapping in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-3.patch: lib: Prepare
      `m_externalEntityRefHandler` calls for upcoming wrapping in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-4.patch: lib: Prepare
      `m_unknownEncodingHandler` calls for upcoming wrapping in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-5.patch: lib: Register
      `m_attlistDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-6.patch: lib: Register
      `m_characterDataHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-7.patch: lib: Register `m_commentHandler`
      with handler call depth tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-8.patch: lib: Register `m_defaultHandler`
      with handler call depth tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-9.patch: lib: Register
      `m_elementDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-10.patch: lib: Register
      `m_endCdataSectionHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-11.patch: lib: Register
      `m_endDoctypeDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50
CVE-2026-32776 libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32777 libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32778 libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2026-45186 In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML
CVE-2026-41080 libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVE-2026-56408 libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56403 libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-50219 libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset fr
CVE-2026-56412 libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within
CVE-2026-56404 libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56405 libexpat before 2.8.2 has an integer overflow in getAttributeId.


About   -   Send Feedback to @ubuntu_updates