Mageia alert MGASA-2026-0061 (expat)

From:
             
 
Mageia Updates <updates-announce@ml.mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2026-0061: Updated expat packages fix security vulnerabilities
Date:
             
 
Fri, 20 Mar 2026 22:17:41 +0100
Message-ID:
             
 
<20260320211741.44F18A000B@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2026-0061 - Updated expat packages fix security vulnerabilities

Publication date: 20 Mar 2026
URL: https://advisories.mageia.org/MGASA-2026-0061.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2026-32776,
     CVE-2026-32777,
     CVE-2026-32778

Description:
libexpat before 2.7.5 allows a NULL pointer dereference with empty
external parameter entity content. (CVE-2026-32776)
libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
(CVE-2026-32777)
libexpat before 2.7.5 allows a NULL pointer dereference in the function
setContext on retry after an earlier out-of-memory condition.
(CVE-2026-32778)

References:
- https://bugs.mageia.org/show_bug.cgi?id=35227
- https://www.openwall.com/lists/oss-security/2026/03/17/10
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3...
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3...

SRPMS:
- 9/core/expat-2.7.5-1.mga9