UbuntuUpdates.org

Package "libexpat1"

Name: libexpat1

Description:

XML parsing C library - runtime library
Latest version: 2.7.4-1ubuntu0.2
Release: resolute (26.04)
Level: security
Repository: main
Head package: expat
Homepage: https://libexpat.github.io/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libexpat1"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libexpat1" in Resolute

Repository Area Version
base main 2.7.4-1
updates main 2.7.4-1ubuntu0.2

Changelog

Version: 2.7.4-1ubuntu0.2 2026-09-24 17:07:34 UTC

expat (2.7.4-1ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56410-1.patch: xmlwf: protect resolveSystemId from
      integer overflow in expat/xmlwf/xmlfile.c.
    - debian/patches/CVE-2026-56410-2.patch: xmlwf: guard each operator in
      resolveSystemId length sum in expat/xmlwf/xmlfile.c.
    - CVE-2026-56410
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56406.patch: lib: Copy overflow check from
      `XML_Parse` to `XML_ParseBuffer` in expat/lib/xmlparse.c.
    - CVE-2026-56406
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56409.patch: xmlwf: protect output path join from
      integer overflow in expat/xmlwf/xmlwf.c.
    - CVE-2026-56409
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56407.patch: cap entity textLen against signed
      integer overflow in expat/lib/xmlparse.c.
    - CVE-2026-56407
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56411.patch: xmlwf: protect notation list
      allocation from integer overflow in expat/xmlwf/xmlwf.c.
    - CVE-2026-56411
  * SECURITY UPDATE: use after free
    - debian/patches/CVE-2026-56131.patch: lib: protect XML_ResumeParser from
      being called from a handler in expat/lib/xmlparse.c,
      expat/tests/handlers.c, expat/tests/handlers.h, expat/tests/misc_tests.c.
    - CVE-2026-56131
  * SECURITY UPDATE: heap-based buffer overflow
    - debian/patches/CVE-2026-56132-pre.patch: lib: use a `size_t` for group
      sizes in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-1.patch: lib: Remove reuse of `m_groupSize`
      to count `m_scaffIndex` allocation in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-2.patch: lib: doProlog: Fix out-of-bound
      scaffolding index store in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-3.patch: tests: Add a test case for
      scaffolding array limits in shared DTDs in expat/tests/basic_tests.c.
    - debian/patches/CVE-2026-56132-4.patch: lib: Remove unnecessary
      `scaffIndex` expansion in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56132-5.patch: lib: Remove indented scoping of
      `new_connector` local in expat/lib/xmlparse.c.
    - CVE-2026-56132
  * SECURITY UPDATE: out-of-bounds read
    - debian/patches/CVE-2026-72522-1.patch: lib: Improve in-code comment for
      functions *toUtf16 in expat/lib/xmltok.c.
    - debian/patches/CVE-2026-72522-2.patch: lib: Stop functions *_toUtf16 from
      mis-classifying low surrogates as high surrogates in expat/lib/xmltok.c.
    - debian/patches/CVE-2026-72522-3.patch: tests/misc_tests.c: Cover Unicode
      surrogate mix-up in expat/tests/misc_tests.c.
    - debian/patches/CVE-2026-72522-4.patch: lib: Make an exit condition in
      `storeAttributeValue` more defensive in expat/lib/xmlparse.c.
    - CVE-2026-72522
  * SECURITY UPDATE: denial of service (algorithmic complexity of storeAtts())
    - debian/patches/CVE-2026-66046.patch: lib: Rename hash table
      `defaultAttsNames` to `defaultAttForName` in expat/lib/xmlparse.c.
    - CVE-2026-66046
  * SECURITY UPDATE: out-of-bounds read
    - debian/patches/CVE-2026-76641.patch: lib: Fix out-of-bounds read from hash
      table entries created by dtdCopy in expat/lib/xmlparse.c,
      expat/tests/basic_tests.c.
    - CVE-2026-76641
  * SECURITY UPDATE: use after free
    - debian/patches/CVE-2026-76957-1.patch: Protect custom encoding callbacks
      from parser reentry in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-76957-2.patch: Test custom encoding callback
      reentry protection in expat/tests/misc_tests.c.
    - CVE-2026-76957

 -- Isabel Garcia Contreras Mon, 21 Sep 2026 15:56:10 -0400
Source diff to previous version
CVE-2026-56410 xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56406 libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
CVE-2026-56409 xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
CVE-2026-56407 libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
CVE-2026-56411 xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-56131 libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a us
CVE-2026-56132 In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled w
CVE-2026-72522 libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Uni
CVE-2026-66046 Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c,
CVE-2026-76641 Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external e
CVE-2026-76957 libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CV

Version: 2.7.4-1ubuntu0.1 2026-09-21 15:07:35 UTC

expat (2.7.4-1ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: NULL function-pointer dereference
    - debian/patches/CVE-2026-32776.patch: Fix NULL function-pointer dereference
      for empty external parameter entities in expat/lib/xmlparse.c,
      expat/tests/basic_tests.c.
    - CVE-2026-32776
  * SECURITY UPDATE: infinite loop while parsing DTD content
    - debian/patches/CVE-2026-32777-1.patch: lib: Reject XML_TOK_INSTANCE_START
      infinite loop in entityValueProcessor in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-32777-2.patch: misc_tests.c: Cover
      XML_TOK_INSTANCE_START infinite loop case in expat/tests/misc_tests.c.
    - CVE-2026-32777
  * SECURITY UPDATE: NULL pointer dereference
    - debian/patches/CVE-2026-32778-1.patch: copy prefix name to pool before
      lookup in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-32778-2.patch: test that we do not end up with a
      zombie PREFIX in the pool in expat/tests/nsalloc_tests.c.
    - CVE-2026-32778
  * SECURITY UPDATE: denial of service via moderately sized crafted XML input
    - debian/patches/CVE-2026-45186-1.patch: Make
      "counting_start_element_handler" count default attrs in
      expat/tests/basic_tests.c, expat/tests/handlers.c, expat/tests/handlers.h.
    - debian/patches/CVE-2026-45186-2.patch: test(attlist): Cover duplicate
      attribute names in expat/tests/basic_tests.c.
    - debian/patches/CVE-2026-45186-3.patch: tests: Define .attributes the first
      time around in expat/tests/basic_tests.c.
    - debian/patches/CVE-2026-45186-4.patch: tests: Make
      counting_start_element_handler enforce complete attribute lists in
      expat/tests/handlers.c.
    - debian/patches/CVE-2026-45186-5.patch: lib: Extract a constant for
      upcoming reuse in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-45186-6.patch: lib: Introduce
      ELEMENT_TYPE.defaultAttsNames in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-45186-7.patch: lib: Leverage
      ELEMENT_TYPE.defaultAttsNames for attribute collision detection in
      expat/lib/xmlparse.c.
    - CVE-2026-45186
  * SECURITY UPDATE: hash flooding caused by insufficient entropy
    - debian/patches/CVE-2026-41080-1.patch: lib: Inline function
      `get_hash_secret_salt` in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-2.patch: lib: Drop unused parameter from
      function `generate_hash_secret_salt` in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-3.patch: lib: Migrate hash salt storage to
      larger `struct sipkey` in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-4.patch: lib: Drop unneeded `void *` casts
      in function `generate_hash_secret_salt` in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-5.patch: lib: Extract 16 bytes of entropy
      (instead of 4 to 8) for hash flooding protection in expat/lib/internal.h,
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-6.patch: lib: Introduce internal flag
      `m_hash_secret_salt_set` in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-7.patch: lib: Introduce API function
      `XML_SetHashSalt16Bytes` in expat/lib/expat.h, expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-8.patch: lib: Include `XML_SetHashSalt*`
      with entropy debugging in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-9.patch: tests: Add basic coverage to
      `XML_SetHashSalt16Bytes` in expat/tests/basic_tests.c.
    - debian/patches/CVE-2026-41080-10.patch: doc: Document `XML_SetHashSalt` as
      being deprecated in expat/lib/expat.h, expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-41080-11.patch: cmake|windows: add missing export
      for new XML_SetHashSalt16Bytes in expat/lib/libexpat.def.cmake.
    - CVE-2026-41080
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56408.patch: lib: Waterproof `copyString` from
      integer overflow in expat/lib/xmlparse.c.
    - CVE-2026-56408
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56403-1.patch: lib: Protect function `storeAtts`
      from signed integer overflow in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56403-2.patch: xmlwf: Protect function `xcsdup`
      from signed integer overflow in expat/xmlwf/xmlwf.c.
    - CVE-2026-56403
  * SECURITY UPDATE: use after free
    - debian/patches/CVE-2026-50219-1.patch: lib: Introduce handler call depth
      tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-2.patch: lib: Prepare
      `m_notStandaloneHandler` calls for upcoming wrapping in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-3.patch: lib: Prepare
      `m_externalEntityRefHandler` calls for upcoming wrapping in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-4.patch: lib: Prepare
      `m_unknownEncodingHandler` calls for upcoming wrapping in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-5.patch: lib: Register
      `m_attlistDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-6.patch: lib: Register
      `m_characterDataHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-7.patch: lib: Register `m_commentHandler`
      with handler call depth tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-8.patch: lib: Register `m_defaultHandler`
      with handler call depth tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-9.patch: lib: Register
      `m_elementDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-10.patch: lib: Register
      `m_endCdataSectionHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-11.patch: lib: Register
      `m_endDoctypeDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50
CVE-2026-32776 libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32777 libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32778 libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2026-45186 In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML
CVE-2026-41080 libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVE-2026-56408 libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56403 libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-50219 libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset fr
CVE-2026-56412 libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within
CVE-2026-56404 libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56405 libexpat before 2.8.2 has an integer overflow in getAttributeId.


About   -   Send Feedback to @ubuntu_updates