Debian alert DLA-4807-1 (expat)

From:
             
 
Andrej Shadura <andrewsh@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4807-1] expat security update
Date:
             
 
Thu, 01 Oct 2026 00:31:42 +0200
Message-ID:
             
 
<20260930223144.453865-1-andrewsh@debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4807-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Andrej Shadura
October 01, 2026                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : expat
Version        : 2.5.0-1+deb12u4
CVE ID         : CVE-2024-28757 CVE-2025-59375 CVE-2026-24515 CVE-2026-25210 
                 CVE-2026-32776 CVE-2026-32777 CVE-2026-32778 CVE-2026-45186 
                 CVE-2026-66046 CVE-2026-93990

Multiple vulnerabilities have been found in expat.

CVE-2024-28757

    A crafted XML document could trigger an entity expansion attack
    (billion laughs attack) when handled by an isolated external parser
    created via XML_ExternalEntityParserCreate bypassing the protections
    that applied to the parser's main document.

CVE-2025-59375

    Small documents could trigger very large dynamic memory
    allocations potentially resulting in a denial of service.

CVE-2026-24515

    XML_ExternalEntityParserCreate did not copy the unknown encoding
    handler's user data to the new external parser, which could result
    in a dangling pointer being used by the subparser.

CVE-2026-25210

    The doContent function did not properly detect an integer overflow
    while reallocating the tag buffer for a long tag name, potentially
    resulting in a heap-based buffer overflow.

CVE-2026-32776

    A crafter XML document could trigger NULL pointer dereference with
    empty external parameter entity content resulting in a denial of
    service.

CVE-2026-32777

    A crafted XML document could trigger an infinite loop while parsing
    DTD content in entityValueProcessor resulting in a denial of
    service.

CVE-2026-32778

    A crafted XML document using a namespace prefix could trigger a NULL
    pointer dereference after an earlier ouf-of-memory condition.

CVE-2026-45186

    The computational complexity of handling default attributes was
    quadratic in the number of distinct attribute names which allowed
    a moderately sized crafted XML input to cause a denial of service.

CVE-2026-66046

    A crafted XML document with a large number of distinct attributes
    could trigger a denial of service due to an O(N^2) linear-time
    attribute lookup.

CVE-2026-93990

    Expat did not validate that a UTF-16 high surrogate was followed
    by a low surrogate, which could result in malformed UTF-16 data
    (unpaired surrogated) being accepted.

For Debian 12 bookworm, these problems have been fixed in version
2.5.0-1+deb12u4.

We recommend that you upgrade your expat packages.

For the detailed security status of expat please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/expat

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQSD3NF/RLIsyDZW7aHoRGtKyMdyYQUCar2NuwAKCRDoRGtKyMdy
YeV9AP97i1Xylgttg4jaIwcsUdPXvkpwLTl1869dgkW6xW1GDAEAloD4/3/6Q7N9
FGQVuQpT/ttMtvLVI2GjMBVYPeeUngU=
=nPqg
-----END PGP SIGNATURE-----