UbuntuUpdates.org

Package "expat"

Name: expat

Description:

XML parsing C library - example application
Latest version: 2.4.7-1ubuntu0.8
Release: jammy (22.04)
Level: security
Repository: universe
Homepage: https://libexpat.github.io/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "expat"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "expat" in Jammy

Repository Area Version
base main 2.4.7-1
base universe 2.4.7-1
security main 2.4.7-1ubuntu0.8
updates main 2.4.7-1ubuntu0.8
updates universe 2.4.7-1ubuntu0.8

Changelog

Version: 2.4.7-1ubuntu0.8 2026-09-21 15:07:31 UTC

expat (2.4.7-1ubuntu0.8) jammy-security; urgency=medium

  * SECURITY UPDATE: NULL function-pointer dereference
    - debian/patches/CVE-2026-32776.patch: Fix NULL function-pointer dereference
      for empty external parameter entities in expat/lib/xmlparse.c,
      expat/tests/runtests.c.
    - CVE-2026-32776
  * SECURITY UPDATE: infinite loop while parsing DTD content
    - debian/patches/CVE-2026-32777-1.patch: lib: Reject XML_TOK_INSTANCE_START
      infinite loop in entityValueProcessor in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-32777-2.patch: misc_tests.c: Cover
      XML_TOK_INSTANCE_START infinite loop case in expat/tests/runtests.c.
    - CVE-2026-32777
  * SECURITY UPDATE: NULL pointer dereference
    - debian/patches/CVE-2026-32778-1.patch: copy prefix name to pool before
      lookup in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-32778-2.patch: test that we do not end up with a
      zombie PREFIX in the pool in expat/tests/runtests.c.
    - CVE-2026-32778
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56408.patch: lib: Waterproof `copyString` from
      integer overflow in expat/lib/xmlparse.c.
    - CVE-2026-56408
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-56403-pre1.patch: Replace the empty for-loops with
      while loops in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56403-1.patch: lib: Protect function `storeAtts`
      from signed integer overflow in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-56403-2.patch: xmlwf: Protect function `xcsdup`
      from signed integer overflow in expat/xmlwf/xmlwf.c, expat/lib/expat.h.
    - CVE-2026-56403
  * SECURITY UPDATE: use after free
    - debian/patches/CVE-2026-50219-1.patch: lib: Introduce handler call depth
      tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-2.patch: lib: Prepare
      `m_notStandaloneHandler` calls for upcoming wrapping in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-3.patch: lib: Prepare
      `m_externalEntityRefHandler` calls for upcoming wrapping in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-4.patch: lib: Prepare
      `m_unknownEncodingHandler` calls for upcoming wrapping in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-5.patch: lib: Register
      `m_attlistDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-6.patch: lib: Register
      `m_characterDataHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-7.patch: lib: Register `m_commentHandler`
      with handler call depth tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-8.patch: lib: Register `m_defaultHandler`
      with handler call depth tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-9.patch: lib: Register
      `m_elementDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-10.patch: lib: Register
      `m_endCdataSectionHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-11.patch: lib: Register
      `m_endDoctypeDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-12.patch: lib: Register
      `m_endElementHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-13.patch: lib: Register
      `m_endNamespaceDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-14.patch: lib: Register
      `m_entityDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-15.patch: lib: Register
      `m_externalEntityRefHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-16.patch: lib: Register
      `m_notationDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-17.patch: lib: Register
      `m_notStandaloneHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-18.patch: lib: Register
      `m_processingInstructionHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-19.patch: lib: Register
      `m_skippedEntityHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-20.patch: lib: Register
      `m_startCdataSectionHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-21.patch: lib: Register
      `m_startDoctypeDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-22.patch: lib: Register
      `m_startElementHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-23.patch: lib: Register
      `m_startNamespaceDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-24.patch: lib: Register
      `m_unknownEncodingHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-25.patch: lib: Register
      `m_unparsedEntityDeclHandler` with handler call depth tracking in
      expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-26.patch: lib: Register `m_xmlDeclHandler`
      with handler call depth tracking in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-27.patch: lib: Protect `XML_GetBuffer` from
      being called from a handler in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-28.patch: lib: Protect `XML_Parse` from
      being called from a handler in expat/lib/xmlparse.c.
    - debian/patches/CVE-2026-50219-29.patch: lib: Protect `X
Source diff to previous version
CVE-2026-32776 libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-32777 libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32778 libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2026-56408 libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56403 libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-50219 libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset fr
CVE-2026-56412 libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within
CVE-2026-56404 libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56405 libexpat before 2.8.2 has an integer overflow in getAttributeId.

Version: 2.4.7-1ubuntu0.7 2026-02-10 19:08:27 UTC

  expat (2.4.7-1ubuntu0.7) jammy-security; urgency=medium

  * SECURITY UPDATE: NULL pointer dereference
    - debian/patches/CVE-2026-24515.patch: updates
      XML_ExternalEntityParserCreate to copy unknown encoding handler user
      data in expat/lib/xmlparse.c.
    - CVE-2026-24515
  * SECURITY UPDATE: integer overflow
    - debian/patches/CVE-2026-25210*.patch: adds an integer overflow check for
      tag buffer reallocation in the doContent function of
      expat/lib/xmlparse.c.
    - CVE-2026-25210

 -- Ian Constantin <email address hidden> Wed, 04 Feb 2026 17:24:04 +0200
Source diff to previous version
CVE-2026-24515 In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
CVE-2026-25210 In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for t

Version: 2.4.7-1ubuntu0.6 2025-04-08 11:07:43 UTC

  expat (2.4.7-1ubuntu0.6) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service via stack overflow
    - debian/patches/CVE-2024-8176-pre.patch: Remove XML_DTD guards
      before is_param accesses
    - debian/patches/CVE-2024-8176-test-pre-1.patch: minicheck: Add
      fail_unless() macro
    - debian/patches/CVE-2024-8176-test-pre-2.patch: tests: Rename
      _fail_unless to _assert_true for clarity
    - debian/patches/CVE-2024-8176-test-pre-3.patch: minicheck: Add
      simple subtest support
    - debian/patches/CVE-2024-8176-1.patch: Resolve the recursion during
      entity processing to prevent stack overflow
    - debian/patches/CVE-2024-8176-2.patch: Stop updating event pointer
      on exit for reentry
    - CVE-2024-8176

 -- Vyom Yadav <email address hidden> Mon, 07 Apr 2025 20:07:15 +0530
Source diff to previous version
CVE-2024-8176 A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an

Version: 2.4.7-1ubuntu0.5 2024-12-10 01:07:24 UTC

  expat (2.4.7-1ubuntu0.5) jammy-security; urgency=medium

  * SECURITY UPDATE: denial-of-service via XML_ResumeParser
    - debian/patches/CVE-2024-50602-1.patch: Make function XML_StopParser of
      expat/lib/xmlparse.c refuse to stop/suspend an unstarted parser
    - debian/patches/CVE-2024-50602-2.patch: Add XML_PARSING case to parser
      state in function XML_StopParser of expat/lib/xmlparse.c
    - debian/patches/CVE-2024-50602-3.patch: Add tests for CVE-2024-50602 to
      expat/tests/runtests.c
    - CVE-2024-50602

 -- Nicolas Campuzano Jimenez <email address hidden> Sun, 01 Dec 2024 15:51:42 -0500
Source diff to previous version
CVE-2024-50602 An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an un

Version: 2.4.7-1ubuntu0.4 2024-09-17 15:07:33 UTC

  expat (2.4.7-1ubuntu0.4) jammy-security; urgency=medium

  * SECURITY UPDATE: invalid input length
    - CVE-2024-45490-*.patch: adds a check to the XML_ParseBuffer function of
      expat/lib/xmlparse.c to identify and error out if a negative length is
      provided.
    - CVE-2024-45490
  * SECURITY UPDATE: integer overflow
    - CVE-2024-45491.patch: adds a check to the dtdCopy function of
      expat/lib/xmlparse.c to detect and prevent an integer overflow.
    - CVE-2024-45491
  * SECURITY UPDATE: integer overflow
    - CVE-2024-45492.patch: adds a check to the nextScaffoldPart function of
      expat/lib/xmlparse.c to detect and prevent an integer overflow.
    - CVE-2024-45492

 -- Ian Constantin <email address hidden> Tue, 10 Sep 2024 13:17:45 +0300
CVE-2024-45490 An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.
CVE-2024-45491 An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT
CVE-2024-45492 An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (wh


About   -   Send Feedback to @ubuntu_updates