{"id":"CVE-2026-56403","aliases":["ALPINE-CVE-2026-56403","AZL-90240","BELL-CVE-2026-56403","CLSA-2026-1784032274","CLSA-2026-1784111441","DEBIAN-CVE-2026-56403","EUVD-2026-38180","GHSA-xqw9-f65g-5qxw","JLSEC-2026-1227","MGASA-2026-0352","OESA-2026-2973","OESA-2026-2974","OESA-2026-2975","OESA-2026-2976","ROOT-OS-DEBIAN-11-CVE-2026-56403","ROOT-OS-DEBIAN-12-CVE-2026-56403","ROOT-OS-DEBIAN-13-CVE-2026-56403","SUSE-SU-2026:23894-1","SUSE-SU-2026:23912-1","SUSE-SU-2026:24260-1","SUSE-SU-2026:24323-1","SUSE-SU-2026:24460-1","SUSE-SU-2026:24469-1","SUSE-SU-2026:24554-1","SUSE-SU-2026:4615-1","SUSE-SU-2026:4619-1","SUSE-SU-2026:4623-1","SUSE-SU-2026:4736-1","SUSE-SU-2026:4806-1","SUSE-SU-2026:4834-1","UBUNTU-CVE-2026-56403","USN-8790-1","openSUSE-SU-2026:11584-1","openSUSE-SU-2026:21945-1","openSUSE-SU-2026:22139-1","openSUSE-SU-2026:22177-1"],"status":"published","title":"libexpat before 2.8.2 has an integer overflow in storeAtts.","description":"libexpat before 2.8.2 has an integer overflow in storeAtts.","severity":{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00168,"percentile":0.06147,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-06-21T15:43:55Z","modified":"2026-11-07T17:27:07Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"expat","fixed_in":["2.8.2-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"expat","fixed_in":["2.8.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"expat","fixed_in":["2.5.0-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.8.2-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.8.2-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Expat_jll","fixed_in":["2.8.2+0"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"expat","fixed_in":["2.2.10-2+deb11u7.aikido.17","2.2.10-2+deb11u7.aikido.19","2.2.10-2+deb11u7.aikido.18","2.2.10-2+deb11u7.aikido.20","2.2.10-2+deb11u7.root.io.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-expat","fixed_in":["2.2.10-2+deb11u7.aikido.17","2.2.10-2+deb11u7.aikido.19","2.2.10-2+deb11u7.aikido.18","2.2.10-2+deb11u7.aikido.20","2.2.10-2+deb11u7.root.io.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","fixed_in":["2.1.0-4ubuntu1.4+esm12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","fixed_in":["2.1.0-7ubuntu0.16.04.5+esm13"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","fixed_in":["2.2.5-3ubuntu0.9+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"expat","fixed_in":["2.2.9-1ubuntu0.8+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"expat","fixed_in":["2.4.7-1ubuntu0.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"expat","fixed_in":["2.6.1-2ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"expat","fixed_in":["2.7.4-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-r0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1-r0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9-r0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-r0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.1-r0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9-r0"},{"fixed":"2.8.2-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-5.el9_6.tuxcare.els9"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-5.el9_6.tuxcare.els9"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-5.el9_6.tuxcare.els9"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9_2.tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9_2.tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el9_2.tuxcare.els13"}]}],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1+deb12u3"}]}],"versions":["2.5.0-1","2.5.0-1+deb12u1","2.5.0-1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1~deb13u1"}]}],"versions":["2.7.1-2","2.7.2-1","2.7.3-1","2.7.3-2","2.7.4-1","2.7.5-1","2.8.0-1","2.8.0-2","2.8.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1"}]}],"versions":["2.7.1-2","2.7.2-1","2.7.3-1","2.7.3-2","2.7.4-1","2.7.5-1","2.8.0-1","2.8.0-2","2.8.1-1","2.8.2-1~deb13u1"]},{"source":"osv","ecosystem":"Julia","package":"Expat_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.8.2+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.3-1.mga10"}]}],"bundled":14},{"source":"osv","ecosystem":"Mageia:10","package":"mingw-expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.3-1.mga10"}]}],"bundled":14},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-28.oe2003sp4"}]}],"bundled":10},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-27.oe2203sp4"}]}],"bundled":10},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-23.oe2403sp1"}]}],"bundled":10},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-22.oe2403sp3"}]}],"bundled":10},{"source":"osv","ecosystem":"Root:Debian:11","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u7.aikido.17"},{"fixed":"2.2.10-2+deb11u7.aikido.19"},{"fixed":"2.2.10-2+deb11u7.aikido.18"},{"fixed":"2.2.10-2+deb11u7.aikido.20"},{"fixed":"2.2.10-2+deb11u7.root.io.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-2+deb11u7.aikido.17"},{"fixed":"2.2.10-2+deb11u7.aikido.19"},{"fixed":"2.2.10-2+deb11u7.aikido.18"},{"fixed":"2.2.10-2+deb11u7.aikido.20"},{"fixed":"2.2.10-2+deb11u7.root.io.16"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-160000.1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-160000.1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-160000.1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-160000.1.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-160000.1.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-159998.1.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-160000.1.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-slfo.1.1_1.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-21.55.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-21.55.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150700.3.15.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-150400.3.40.1"}]}],"bundled":34},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.13.9.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.13.9.1"}]}],"bundled":86},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-118.16.2"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-118.16.2"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-150400.157.16.1"}]}],"bundled":85},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50-3","3.1.4~abc9f50-4","3.1.4~abc9f50-4ubuntu2","3.1.4~abc9f50-4ubuntu2+esm1","3.1.4~abc9f50-4ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm12"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4","2.1.0-4ubuntu1.4+esm6","2.1.0-4ubuntu1.4+esm7","2.1.0-4ubuntu1.4+esm8","2.1.0-4ubuntu1.4+esm9","2.1.0-4ubuntu1.4+esm10","2.1.0-4ubuntu1.4+esm11"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37ubuntu5","4.1.1+xorg4.3.0-37ubuntu5.0.1","4.1.1+xorg4.3.0-37ubuntu5.0.2","4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14ubuntu1","5.8.0-14ubuntu3","5.8.0-14.1ubuntu2","5.8.0-14.1ubuntu3","5.8.0-14.1ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.33-3.2ubuntu3","1.33.06-0ubuntu1","1.33.06-0ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm13"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2","2.1.0-7ubuntu0.16.04.5+esm5","2.1.0-7ubuntu0.16.04.5+esm6","2.1.0-7ubuntu0.16.04.5+esm7","2.1.0-7ubuntu0.16.04.5+esm8","2.1.0-7ubuntu0.16.04.5+esm9","2.1.0-7ubuntu0.16.04.5+esm10","2.1.0-7ubuntu0.16.04.5+esm11","2.1.0-7ubuntu0.16.04.5+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ayttm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.3-3build1","0.6.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cableswig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0+git20150808-1","0.1.0+git20150808-2","0.1.0+git20150808-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.4-4","2.4.4-4build1","2.4.4-4ubuntu1","2.6.1-3","2.6.2-1","2.6.2-2","2.6.2-3","2.6.3-1","2.6.3-1ubuntu1","2.6.3-2ubuntu1","2.6.3-3ubuntu1","2.6.3-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1ubuntu3","4.8.1-1ubuntu4","4.8.2-3.1ubuntu1","4.9.0-3ubuntu2","4.9.0-4ubuntu1","4.9.0-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-3build3","1.2-3ubuntu0.1~esm1","1.2-3ubuntu0.16.04.1~esm1","1.2-3ubuntu0.16.04.1~esm2","1.2-3ubuntu0.16.04.1~esm3","1.2-3ubuntu0.16.04.1~esm4","1.2-3ubuntu0.16.04.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-4","2.4.7-4build1","2.4.7-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2","4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.1+dfsg-2","5.10.1+dfsg-2build3","5.10.1+dfsg-2.1build1","5.10.1+dfsg-2.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-0.2ubuntu3","1.33.14-1ubuntu1","1.33.14-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+esm4"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7","2.2.5-3ubuntu0.8","2.2.5-3ubuntu0.9","2.2.5-3ubuntu0.9+esm1","2.2.5-3ubuntu0.9+esm2","2.2.5-3ubuntu0.9+esm3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-2","3.1.4~abc9f50+dfsg2-1","3.1.4~abc9f50+dfsg3-1","3.1.4~abc9f50+dfsg3-2","3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gdcm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-3build1","2.8.3-1","2.8.4-1","2.8.4-1build2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4ubuntu0.18.04.1~esm1","1.2-4ubuntu0.18.04.1~esm2","1.2-4ubuntu0.18.04.1~esm3","1.2-4ubuntu0.18.04.1~esm4","1.2-4ubuntu0.18.04.1~esm5","1.2-4ubuntu0.18.04.1~esm6","1.2-4ubuntu0.18.04.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5build1","0.13+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"smart","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-5ubuntu1","2.4.7-5ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1","0.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1","0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-7","1.33.14-8","1.33.14-8build1","1.33.14-8ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.8+esm2"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4","2.2.9-1ubuntu0.5","2.2.9-1ubuntu0.6","2.2.9-1ubuntu0.7","2.2.9-1ubuntu0.8","2.2.9-1ubuntu0.8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-4.1ubuntu1","4.13.2-dfsg1-1ubuntu1","4.13.2-dfsg1-4ubuntu1","4.13.2-dfsg1-6","4.13.2-dfsg1-6ubuntu1","4.13.2-dfsg1-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4ubuntu0.20.04.1~esm1","1.2-4ubuntu0.20.04.1~esm2","1.2-4ubuntu0.20.04.1~esm3","1.2-4ubuntu0.20.04.1~esm4","1.2-4ubuntu0.20.04.1~esm5","1.2-4ubuntu0.20.04.1~esm6","1.2-4ubuntu0.20.04.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-6","0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build1","2.4.7-6build2","2.4.7-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-8build1","1.33.14-8build2","1.33.14-8ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.8"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1","2.4.7-1ubuntu0.2","2.4.7-1ubuntu0.3","2.4.7-1ubuntu0.4","2.4.7-1ubuntu0.5","2.4.7-1ubuntu0.6","2.4.7-1ubuntu0.7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.3withdata-dfsg1-4.1","4.13.3withdata-dfsg2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.7-1build1","0.11.7+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build3","2.4.7-6.1","2.4.7-6.1build1","2.4.7-6.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-9","1.33.14-10","1.33.14-10ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24+dfsg-2","0.24+dfsg-3","0.24+dfsg-3build1","0.24+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2ubuntu0.5"}]}],"versions":["2.5.0-2","2.6.0-1","2.6.1-2","2.6.1-2build1","2.6.1-2ubuntu0.1","2.6.1-2ubuntu0.2","2.6.1-2ubuntu0.3","2.6.1-2ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4ubuntu1","1.2-4.1ubuntu1","1.2-4.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1","0.13+ds2-1build1","0.13+ds2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.3-1","0.9.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.8+dfsg-3","0.11.8+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.2","2.4.7-6.2build1","2.4.7-6.2build2","2.4.7-6.2build3","2.4.7-6.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-11","1.33.14-11.1","1.33.14-12","1.33.14-12build1","1.33.14-12build2","1.33.14-12ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.7.1-1","2.7.1-2","2.7.1-2ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.3","2.4.7-6.3build1","2.4.7-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-2","0.9.5.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-7","1.59.03-9","1.59.03-10","1.59.03-10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7.1","2.4.7-7.2","2.4.7-7.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-2","0.9.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-3","0.11.10+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.05-1","1.60.05-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2","0.28+dfsg-1","0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-1ubuntu0.1"}]}],"versions":["2.7.1-2","2.7.3-1","2.7.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2","0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-3","0.9.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2","0.11.10+dfsg-2build1","0.11.10+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-10.1","1.60.05-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7","2.4.7-7.1","2.4.7-7.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4ubuntu1.4+esm12"}]}],"versions":["2.1.0-4","2.1.0-4ubuntu1","2.1.0-4ubuntu1.1","2.1.0-4ubuntu1.2","2.1.0-4ubuntu1.3","2.1.0-4ubuntu1.4","2.1.0-4ubuntu1.4+esm1","2.1.0-4ubuntu1.4+esm2","2.1.0-4ubuntu1.4+esm4","2.1.0-4ubuntu1.4+esm6","2.1.0-4ubuntu1.4+esm7","2.1.0-4ubuntu1.4+esm8","2.1.0-4ubuntu1.4+esm9","2.1.0-4ubuntu1.4+esm10","2.1.0-4ubuntu1.4+esm11"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-7ubuntu0.16.04.5+esm13"}]}],"versions":["2.1.0-7","2.1.0-7ubuntu0.16.04.1","2.1.0-7ubuntu0.16.04.2","2.1.0-7ubuntu0.16.04.3","2.1.0-7ubuntu0.16.04.4","2.1.0-7ubuntu0.16.04.5","2.1.0-7ubuntu0.16.04.5+esm2","2.1.0-7ubuntu0.16.04.5+esm5","2.1.0-7ubuntu0.16.04.5+esm6","2.1.0-7ubuntu0.16.04.5+esm7","2.1.0-7ubuntu0.16.04.5+esm8","2.1.0-7ubuntu0.16.04.5+esm9","2.1.0-7ubuntu0.16.04.5+esm10","2.1.0-7ubuntu0.16.04.5+esm11","2.1.0-7ubuntu0.16.04.5+esm12"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3ubuntu0.9+esm4"}]}],"versions":["2.2.3-1","2.2.3-2","2.2.5-0ubuntu2","2.2.5-3","2.2.5-3ubuntu0.1","2.2.5-3ubuntu0.2","2.2.5-3ubuntu0.4","2.2.5-3ubuntu0.7","2.2.5-3ubuntu0.8","2.2.5-3ubuntu0.9","2.2.5-3ubuntu0.9+esm1","2.2.5-3ubuntu0.9+esm2","2.2.5-3ubuntu0.9+esm3"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1ubuntu0.8+esm2"}]}],"versions":["2.2.7-2","2.2.9-1","2.2.9-1build1","2.2.9-1ubuntu0.2","2.2.9-1ubuntu0.4","2.2.9-1ubuntu0.5","2.2.9-1ubuntu0.6","2.2.9-1ubuntu0.7","2.2.9-1ubuntu0.8","2.2.9-1ubuntu0.8+esm1"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-1ubuntu0.8"}]}],"versions":["2.4.1-2","2.4.1-3","2.4.2-1","2.4.3-1","2.4.3-2","2.4.4-1","2.4.6-1","2.4.7-1","2.4.7-1ubuntu0.1","2.4.7-1ubuntu0.2","2.4.7-1ubuntu0.3","2.4.7-1ubuntu0.4","2.4.7-1ubuntu0.5","2.4.7-1ubuntu0.6","2.4.7-1ubuntu0.7"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1-2ubuntu0.5"}]}],"versions":["2.5.0-2","2.6.0-1","2.6.1-2","2.6.1-2build1","2.6.1-2ubuntu0.1","2.6.1-2ubuntu0.2","2.6.1-2ubuntu0.3","2.6.1-2ubuntu0.4"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.4-1ubuntu0.1"}]}],"versions":["2.7.1-2","2.7.3-1","2.7.4-1"],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4-160000.1.1"}]}],"bundled":20},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.5.0-160000.1.1"}]}],"bundled":85},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-160000.1.1"}]}],"bundled":9}],"products":[{"vendor":"libexpat project","product":"libexpat"},{"vendor":"libexpat_project","product":"libexpat"}],"references":[{"url":"https://github.com/libexpat/libexpat/pull/1232","tags":["Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56403","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xqw9-f65g-5qxw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-56403","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-56403","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784032274.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56132","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56404","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56406","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56410","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56411","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1784111441.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56403.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56403","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0352.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35758","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/25/10","tags":["web"]},{"url":"https://blog.hartwork.org/posts/expat-2-8-2-released/","tags":["web"]},{"url":"https://github.com/libexpat/libexpat/blob/R_2_8_2/expat/Changes","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2973","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56409","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56412","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2974","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2975","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2976","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623894-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262263","tags":["report"]},{"url":"https://bugzilla.suse.com/1264713","tags":["report"]},{"url":"https://bugzilla.suse.com/1267631","tags":["report"]},{"url":"https://bugzilla.suse.com/1268572","tags":["report"]},{"url":"https://bugzilla.suse.com/1268573","tags":["report"]},{"url":"https://bugzilla.suse.com/1275096","tags":["report"]},{"url":"https://bugzilla.suse.com/1275594","tags":["report"]},{"url":"https://bugzilla.suse.com/1275732","tags":["report"]},{"url":"https://bugzilla.suse.com/1275859","tags":["report"]},{"url":"https://bugzilla.suse.com/1275860","tags":["report"]},{"url":"https://bugzilla.suse.com/1275915","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76957","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623912-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624260-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259712","tags":["report"]},{"url":"https://bugzilla.suse.com/1259727","tags":["report"]},{"url":"https://bugzilla.suse.com/1259730","tags":["report"]},{"url":"https://bugzilla.suse.com/1275098","tags":["report"]},{"url":"https://bugzilla.suse.com/1275605","tags":["report"]},{"url":"https://bugzilla.suse.com/1275736","tags":["report"]},{"url":"https://bugzilla.suse.com/1282347","tags":["report"]},{"url":"https://bugzilla.suse.com/1284493","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109734","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-109783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93990","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624323-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249584","tags":["report"]},{"url":"https://bugzilla.suse.com/1257144","tags":["report"]},{"url":"https://bugzilla.suse.com/1257496","tags":["report"]},{"url":"https://bugzilla.suse.com/1259711","tags":["report"]},{"url":"https://bugzilla.suse.com/1259726","tags":["report"]},{"url":"https://bugzilla.suse.com/1259729","tags":["report"]},{"url":"https://bugzilla.suse.com/1275115","tags":["report"]},{"url":"https://bugzilla.suse.com/1283493","tags":["report"]},{"url":"https://bugzilla.suse.com/1284334","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77214","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624460-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624469-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624554-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264615-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264619-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264623-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264736-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1275108","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110249","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264806-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264834-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-56403","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56403","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8790-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-59375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-32776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-32777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-32778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-41080","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-50219","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56404","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56412","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-56403","description":"libexpat before 2.8.2 has an integer overflow in storeAtts.","status":"published","published":"2026-06-21T15:43:55.849Z","modified":"2026-06-22T17:05:39.258Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-38180","description":"libexpat before 2.8.2 has an integer overflow in storeAtts.","status":"published","published":"2026-06-21T15:43:55Z","modified":"2026-06-22T17:05:39Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:34.238696Z"}],"ghsa":[{"id":"GHSA-xqw9-f65g-5qxw","title":"libexpat before 2.8.2 has an integer overflow in storeAtts.","description":"libexpat before 2.8.2 has an integer overflow in storeAtts.","status":"published","published":"2026-06-21T18:32:18Z","modified":"2026-06-21T18:32:19Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:08:55.672723Z"}],"nvd":[{"id":"CVE-2026-56403","description":"libexpat before 2.8.2 has an integer overflow in storeAtts.","status":"published","published":"2026-06-21T16:16:26.59Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"ALPINE-CVE-2026-56403","description":"libexpat before 2.8.2 has an integer overflow in storeAtts.","status":"published","published":"2026-06-21T16:16:26.59Z","modified":"2026-10-01T02:17:49.354222088Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-56403","status":"published","published":"2026-06-23T06:11:05.444003Z","modified":"2026-07-01T07:15:04.512016011Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-56403","description":"libexpat before 2.8.2 has an integer overflow in storeAtts.","status":"published","published":"2026-06-21T15:43:55.849Z","modified":"2026-11-07T17:27:07.30623514Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-07T17:50:26.336609Z"},{"id":"DEBIAN-CVE-2026-56403","description":"libexpat before 2.8.2 has an integer overflow in storeAtts.","status":"published","published":"2026-06-21T16:16:26.59Z","modified":"2026-10-26T11:47:30.966378451Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"JLSEC-2026-1227","description":"libexpat before 2.8.2 has an integer overflow in storeAtts.","status":"published","published":"2026-08-09T01:27:54.135Z","modified":"2026-08-09T01:30:04.16072264Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-2973","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nlibexpat before 2.8.2 has an integer overflow in storeAtts.(CVE-2026-56403)\n\nlibexpat before 2.8.2 has an integer overflow in addBinding.(CVE-2026-56404)\n\nlibexpat before 2.8.2 has an integer overflow in getAttributeId.(CVE-2026-56405)\n\nlibexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.(CVE-2026-56406)\n\nlibexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.(CVE-2026-56407)\n\nlibexpat before 2.8.2 has an integer overflow in copyString.(CVE-2026-56408)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.(CVE-2026-56409)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.(CVE-2026-56410)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.(CVE-2026-56411)\n\nlibexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.(CVE-2026-56412)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.924054393Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2974","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nlibexpat before 2.8.2 has an integer overflow in storeAtts.(CVE-2026-56403)\n\nlibexpat before 2.8.2 has an integer overflow in addBinding.(CVE-2026-56404)\n\nlibexpat before 2.8.2 has an integer overflow in getAttributeId.(CVE-2026-56405)\n\nlibexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.(CVE-2026-56406)\n\nlibexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.(CVE-2026-56407)\n\nlibexpat before 2.8.2 has an integer overflow in copyString.(CVE-2026-56408)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.(CVE-2026-56409)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.(CVE-2026-56410)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.(CVE-2026-56411)\n\nlibexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.(CVE-2026-56412)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.994318857Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2975","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nlibexpat before 2.8.2 has an integer overflow in storeAtts.(CVE-2026-56403)\n\nlibexpat before 2.8.2 has an integer overflow in addBinding.(CVE-2026-56404)\n\nlibexpat before 2.8.2 has an integer overflow in getAttributeId.(CVE-2026-56405)\n\nlibexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.(CVE-2026-56406)\n\nlibexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.(CVE-2026-56407)\n\nlibexpat before 2.8.2 has an integer overflow in copyString.(CVE-2026-56408)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.(CVE-2026-56409)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.(CVE-2026-56410)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.(CVE-2026-56411)\n\nlibexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.(CVE-2026-56412)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.985175693Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2976","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\n\nlibexpat before 2.8.2 has an integer overflow in storeAtts.(CVE-2026-56403)\n\nlibexpat before 2.8.2 has an integer overflow in addBinding.(CVE-2026-56404)\n\nlibexpat before 2.8.2 has an integer overflow in getAttributeId.(CVE-2026-56405)\n\nlibexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.(CVE-2026-56406)\n\nlibexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.(CVE-2026-56407)\n\nlibexpat before 2.8.2 has an integer overflow in copyString.(CVE-2026-56408)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.(CVE-2026-56409)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.(CVE-2026-56410)\n\nxmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.(CVE-2026-56411)\n\nlibexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.(CVE-2026-56412)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:17.180678155Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-56403","description":"libexpat before 2.8.2 has an integer overflow in storeAtts.","status":"published","published":"2026-06-21T16:16:00Z","modified":"2026-10-17T13:00:28.839722496Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"},{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-90240","title":"CVE-2026-56403 affecting package expat for versions less than 2.8.2-1","description":"libexpat before 2.8.2 has an integer overflow in storeAtts.","status":"published","published":"2026-06-21T16:16:26Z","modified":"2026-08-28T17:56:33.955806Z","updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"CLSA-2026-1784032274","title":"expat: Fix of 7 CVEs","description":"- CVE-2026-56132: fix out-of-bound scaffolding index store in doProlog\n- CVE-2026-56403: protect storeAtts and xmlwf xcsdup from signed integer overflow\n- CVE-2026-56404: protect addBinding from signed integer overflow\n- CVE-2026-56405: protect getAttributeId from signed integer overflow\n- CVE-2026-56406: add missing overflow check to XML_ParseBuffer\n- CVE-2026-56410: protect xmlwf resolveSystemId from integer overflow\n- CVE-2026-56411: protect xmlwf notation list allocation from integer overflow","status":"published","published":"2026-07-14T16:23:56Z","modified":"2026-10-26T09:31:17.897732095Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784111441","title":"expat: Fix of 7 CVEs","description":"- CVE-2026-56132: fix out-of-bound scaffolding index store in doProlog\n- CVE-2026-56403: protect storeAtts and xmlwf xcsdup from signed integer overflow\n- CVE-2026-56404: protect addBinding from signed integer overflow\n- CVE-2026-56405: protect getAttributeId from signed integer overflow\n- CVE-2026-56406: add missing overflow check to XML_ParseBuffer\n- CVE-2026-56410: protect xmlwf resolveSystemId from integer overflow\n- CVE-2026-56411: protect xmlwf notation list allocation from integer overflow","status":"published","published":"2026-07-15T10:31:00Z","modified":"2026-10-26T09:30:11.537217017Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"MGASA-2026-0352","title":"Updated expat \u0026 mingw-expat packages fix security vulnerabilities","description":"Missing control flow integrity checks. (CVE-2026-50219)\nMissing control flow integrity checks. (CVE-2026-56131)\nOut-of-bounds write. (CVE-2026-56132)\nInteger overflow. (CVE-2026-56403)\nInteger overflow. (CVE-2026-56404)\nInteger overflow. (CVE-2026-56405)\nInteger overflow. (CVE-2026-56406)\nInteger overflow. (CVE-2026-56407)\nInteger overflow. (CVE-2026-56408)\nInteger overflow. (CVE-2026-56409)\nInteger overflow. (CVE-2026-56410)\nInteger overflow. (CVE-2026-56411)\nMissing control flow integrity checks. (CVE-2026-56412)\n","status":"published","published":"2026-08-31T19:40:26Z","modified":"2026-08-31T19:45:02.623431757Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11584-1","title":"expat-2.8.2-1.1 on GA media","description":"These are all security issues fixed in the expat-2.8.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-24T00:00:00Z","modified":"2026-08-26T18:23:38.131968799Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21945-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a\n  denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,\n  XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation (bsc#1267631).\n- CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: mishandled memory reallocation during array scaffolding in doProlog can cause heap-based buffer\n  overflows (bsc#1268573).\n- CVE-2026-56403: integer overflow in the storeAtts function can cause memory corruption and potential arbitrary code\n  execution (bsc#1275096).\n- CVE-2026-56404: integer overflow in the addBinding function can cause undersized memory allocations, memory\n  corruption, and application crashes (bsc#1275096).\n- CVE-2026-56405: integer overflow in the getAttributeId function can cause heap memory corruption and arbitrary\n  code execution (bsc#1275096).\n- CVE-2026-56406: missing bounds validation in XML_ParseBuffer can cause integer overflows, memory corruption, and\n  application crashes (bsc#1275096).\n- CVE-2026-56407: integer overflow in doProlog related to entity text length can cause memory corruption and denial\n  of service (bsc#1275096).\n- CVE-2026-56408: integer overflow in the copyString function can cause heap memory corruption and application crashes\n  (bsc#1275096).\n- CVE-2026-56409: integer overflow in the xmlwf utility output filename handling can allow path buffer corruption and\n  arbitrary file write conditions (bsc#1275096).\n- CVE-2026-56410: integer overflow in resolveSystemId within the xmlwf utility can cause memory corruption, information\n  disclosure, and potential code execution (bsc#1275096).\n- CVE-2026-56411: integer overflow in endDoctypeDecl via NOTATION declarations in xmlwf can cause memory corruption and\n  denial of service (bsc#1275096).\n- CVE-2026-56412: incomplete handler call depth tracking in doCdataSection can cause use-after-free\n  conditions and arbitrary code execution (bsc#1275096).\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the\n  storeAtts() function in xmlparse.c (bsc#1275732).\n- CVE-2026-72522: libexpat: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to\n  insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via\n  crafted X (bsc#1275860).\n- CVE-2026-76957: libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. (bsc#1275859).\n\nChanges for expat:\n\n- Updated to version 2.8.4\n","status":"published","published":"2026-09-24T07:03:56Z","modified":"2026-09-25T18:23:14.327905672Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22139-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\nFirefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):\n\n- CVE-2026-109704: Privilege escalation in the Application Update component.\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the\n  Networking component.\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.\n- CVE-2026-109710: Use-after-free in the Graphics: Text component.\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.\n- CVE-2026-109713: Use-after-free in the Crash Reporting component.\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-109718: Use-after-free in the XML component.\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.\n- CVE-2026-109724: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109725: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109726: Use-after-free in the SVG component.\n- CVE-2026-109727: Use-after-free in the Audio/Video component.\n- CVE-2026-109728: Use-after-free in the DOM: Animation component.\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-109730: Integer overflow in the Graphics component.\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.\n- CVE-2026-109732: Use-after-free in the DOM: Streams component.\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component.\n- CVE-2026-109736: Frame poisoning in the Layout component.\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.\n- CVE-2026-109742: Information disclosure in the PDF Viewer component.\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component.\n- CVE-2026-109744: Other issue in the DOM: File component.\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.\n- CVE-2026-109751: Information disclosure in the Networking component.\n- CVE-2026-109752: Use-after-free in the DOM: Workers component.\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component.\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component.\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component.\n- CVE-2026-109759: Site isolation issue in the Networking component.\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component.\n- CVE-2026-109763: Mitigation bypass in the File Handling component.\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109767: Information disclosure in the Networking component.\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.\n- CVE-2026-109775: Denial-of-service in the WebRTC component.\n- CVE-2026-109776: Race condition in the XPCOM component.\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.\n- CVE-2026-109778: Privilege escalation in the WebExtensions component.\n- CVE-2026-109781: Denial-of-service in the Printing: Output component.\n- CVE-2026-109782: Mitigation bypass in the File Handling component.\n- CVE-2026-109783: Mitigation bypass in the File Handling component.\n\nlibexpat updated:\n\n- CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside\n  an entity declaration value. (bsc#1259727)\n- CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing. (bsc#1259712)\n- CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory condition. (bsc#1259730)\n- CVE-2026-41080: libexpat: insufficient entropy, and thus hash flooding can occur via a crafted XML document. (bsc#1262263)\n- CVE-2026-45186: libexpat: computational complexity of attribute name collision checks allows a denial of service via moderately\n  sized crafted XML input. (bsc#1264713)\n- CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in libexpat could lead to\n  information disclosure, integrity loss, or denial of service. (bsc#1275098)\n- CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for XML_ResumeParser in\n  libexpat could lead to denial of service. (bsc#1275098)\n- CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in libexpat could lead to\n  denial of service or memory corruption. (bsc#1275098)\n- CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in libexpat could lead\n  to memory corruption. (bsc#1275098)\n- CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could lead to memory corruption\n  and potential security risks. (bsc#1275098)\n- CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could lead to memory corruption. (bsc#1275098)\n- CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to denial of service. (bsc#1275098)\n- CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in libexpat could lead to denial of\n  service or memory corruption. (bsc#1275098)\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function\n  in xmlparse.c. (bsc#1275736)\n- CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing functions in libexpat allowed\n  attackers to cause denial of service. (bsc#1275605)\n- CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat allowed attackers to trigger\n  memory corruption or a crash. (bsc#1275736)\n- CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code in libexpat allowed attackers\n  to cause a denial of service via hash flooding attacks. (bsc#1275736)\n- CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with custom encoding callbacks in\n  libexpat could lead to memory corruption. (bsc#1275736)\n- CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat allowed attackers to pass unpaired\n  surrogates or silently replace input characters. (bsc#1282347)\n","status":"published","published":"2026-10-19T14:43:34Z","modified":"2026-10-22T17:23:12.292232274Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"openSUSE-SU-2026:22177-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).\n\nChanges for expat:\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n","status":"published","published":"2026-10-27T16:07:43Z","modified":"2026-11-01T17:23:29.413374471Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-56403","title":"CVE-2026-56403 in expat - Patched by Root","description":"Root has patched CVE-2026-56403 in the expat package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-10-19T10:19:12Z","modified":"2026-10-19T11:15:05.353823082Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-56403","title":"CVE-2026-56403 in expat - Patched by Root","description":"Root has patched CVE-2026-56403 in the expat package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-31T11:47:59Z","modified":"2026-09-07T14:00:04.183815807Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-56403","title":"CVE-2026-56403 in expat - Patched by Root","description":"Root has patched CVE-2026-56403 in the expat package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-31T11:50:58Z","modified":"2026-09-15T14:00:05.621815137Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:23894-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a\n  denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,\n  XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation (bsc#1267631).\n- CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: mishandled memory reallocation during array scaffolding in doProlog can cause heap-based buffer\n  overflows (bsc#1268573).\n- CVE-2026-56403: integer overflow in the storeAtts function can cause memory corruption and potential arbitrary code\n  execution (bsc#1275096).\n- CVE-2026-56404: integer overflow in the addBinding function can cause undersized memory allocations, memory\n  corruption, and application crashes (bsc#1275096).\n- CVE-2026-56405: integer overflow in the getAttributeId function can cause heap memory corruption and arbitrary\n  code execution (bsc#1275096).\n- CVE-2026-56406: missing bounds validation in XML_ParseBuffer can cause integer overflows, memory corruption, and\n  application crashes (bsc#1275096).\n- CVE-2026-56407: integer overflow in doProlog related to entity text length can cause memory corruption and denial\n  of service (bsc#1275096).\n- CVE-2026-56408: integer overflow in the copyString function can cause heap memory corruption and application crashes\n  (bsc#1275096).\n- CVE-2026-56409: integer overflow in the xmlwf utility output filename handling can allow path buffer corruption and\n  arbitrary file write conditions (bsc#1275096).\n- CVE-2026-56410: integer overflow in resolveSystemId within the xmlwf utility can cause memory corruption, information\n  disclosure, and potential code execution (bsc#1275096).\n- CVE-2026-56411: integer overflow in endDoctypeDecl via NOTATION declarations in xmlwf can cause memory corruption and\n  denial of service (bsc#1275096).\n- CVE-2026-56412: incomplete handler call depth tracking in doCdataSection can cause use-after-free\n  conditions and arbitrary code execution (bsc#1275096).\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the\n  storeAtts() function in xmlparse.c (bsc#1275732).\n- CVE-2026-72522: libexpat: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to\n  insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via\n  crafted X (bsc#1275860).\n- CVE-2026-76957: libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. (bsc#1275859).\n\nChanges for expat:\n\n- Updated to version 2.8.4\n","status":"published","published":"2026-09-24T07:07:13Z","modified":"2026-09-30T18:23:11.313620448Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23912-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a\n  denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,\n  XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation (bsc#1267631).\n- CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: mishandled memory reallocation during array scaffolding in doProlog can cause heap-based buffer\n  overflows (bsc#1268573).\n- CVE-2026-56403: integer overflow in the storeAtts function can cause memory corruption and potential arbitrary code\n  execution (bsc#1275096).\n- CVE-2026-56404: integer overflow in the addBinding function can cause undersized memory allocations, memory\n  corruption, and application crashes (bsc#1275096).\n- CVE-2026-56405: integer overflow in the getAttributeId function can cause heap memory corruption and arbitrary\n  code execution (bsc#1275096).\n- CVE-2026-56406: missing bounds validation in XML_ParseBuffer can cause integer overflows, memory corruption, and\n  application crashes (bsc#1275096).\n- CVE-2026-56407: integer overflow in doProlog related to entity text length can cause memory corruption and denial\n  of service (bsc#1275096).\n- CVE-2026-56408: integer overflow in the copyString function can cause heap memory corruption and application crashes\n  (bsc#1275096).\n- CVE-2026-56409: integer overflow in the xmlwf utility output filename handling can allow path buffer corruption and\n  arbitrary file write conditions (bsc#1275096).\n- CVE-2026-56410: integer overflow in resolveSystemId within the xmlwf utility can cause memory corruption, information\n  disclosure, and potential code execution (bsc#1275096).\n- CVE-2026-56411: integer overflow in endDoctypeDecl via NOTATION declarations in xmlwf can cause memory corruption and\n  denial of service (bsc#1275096).\n- CVE-2026-56412: incomplete handler call depth tracking in doCdataSection can cause use-after-free\n  conditions and arbitrary code execution (bsc#1275096).\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the\n  storeAtts() function in xmlparse.c (bsc#1275732).\n- CVE-2026-72522: libexpat: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to\n  insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via\n  crafted X (bsc#1275860).\n- CVE-2026-76957: libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. (bsc#1275859).\n\nChanges for expat:\n\n- Updated to version 2.8.4\n","status":"published","published":"2026-09-24T07:07:13Z","modified":"2026-09-30T18:23:12.534238624Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:24260-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\nFirefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):\n\n- CVE-2026-109704: Privilege escalation in the Application Update component.\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the\n  Networking component.\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.\n- CVE-2026-109710: Use-after-free in the Graphics: Text component.\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.\n- CVE-2026-109713: Use-after-free in the Crash Reporting component.\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-109718: Use-after-free in the XML component.\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.\n- CVE-2026-109724: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109725: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109726: Use-after-free in the SVG component.\n- CVE-2026-109727: Use-after-free in the Audio/Video component.\n- CVE-2026-109728: Use-after-free in the DOM: Animation component.\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-109730: Integer overflow in the Graphics component.\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.\n- CVE-2026-109732: Use-after-free in the DOM: Streams component.\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component.\n- CVE-2026-109736: Frame poisoning in the Layout component.\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.\n- CVE-2026-109742: Information disclosure in the PDF Viewer component.\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component.\n- CVE-2026-109744: Other issue in the DOM: File component.\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.\n- CVE-2026-109751: Information disclosure in the Networking component.\n- CVE-2026-109752: Use-after-free in the DOM: Workers component.\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component.\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component.\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component.\n- CVE-2026-109759: Site isolation issue in the Networking component.\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component.\n- CVE-2026-109763: Mitigation bypass in the File Handling component.\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109767: Information disclosure in the Networking component.\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.\n- CVE-2026-109775: Denial-of-service in the WebRTC component.\n- CVE-2026-109776: Race condition in the XPCOM component.\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.\n- CVE-2026-109778: Privilege escalation in the WebExtensions component.\n- CVE-2026-109781: Denial-of-service in the Printing: Output component.\n- CVE-2026-109782: Mitigation bypass in the File Handling component.\n- CVE-2026-109783: Mitigation bypass in the File Handling component.\n\nlibexpat updated:\n\n- CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside\n  an entity declaration value. (bsc#1259727)\n- CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing. (bsc#1259712)\n- CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory condition. (bsc#1259730)\n- CVE-2026-41080: libexpat: insufficient entropy, and thus hash flooding can occur via a crafted XML document. (bsc#1262263)\n- CVE-2026-45186: libexpat: computational complexity of attribute name collision checks allows a denial of service via moderately\n  sized crafted XML input. (bsc#1264713)\n- CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in libexpat could lead to\n  information disclosure, integrity loss, or denial of service. (bsc#1275098)\n- CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for XML_ResumeParser in\n  libexpat could lead to denial of service. (bsc#1275098)\n- CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in libexpat could lead to\n  denial of service or memory corruption. (bsc#1275098)\n- CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in libexpat could lead\n  to memory corruption. (bsc#1275098)\n- CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could lead to memory corruption\n  and potential security risks. (bsc#1275098)\n- CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could lead to memory corruption. (bsc#1275098)\n- CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to denial of service. (bsc#1275098)\n- CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in libexpat could lead to denial of\n  service or memory corruption. (bsc#1275098)\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function\n  in xmlparse.c. (bsc#1275736)\n- CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing functions in libexpat allowed\n  attackers to cause denial of service. (bsc#1275605)\n- CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat allowed attackers to trigger\n  memory corruption or a crash. (bsc#1275736)\n- CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code in libexpat allowed attackers\n  to cause a denial of service via hash flooding attacks. (bsc#1275736)\n- CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with custom encoding callbacks in\n  libexpat could lead to memory corruption. (bsc#1275736)\n- CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat allowed attackers to pass unpaired\n  surrogates or silently replace input characters. (bsc#1282347)\n","status":"published","published":"2026-10-19T15:16:56Z","modified":"2026-10-23T17:23:10.652324282Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24323-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove \"harmless\" cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-17T13:49:25Z","modified":"2026-10-27T17:23:13.622800769Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24460-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).\n\nChanges for expat:\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n","status":"published","published":"2026-10-27T16:12:58Z","modified":"2026-11-02T17:23:09.756312758Z","updated_at":"2026-11-02T18:00:32.560004Z"},{"id":"SUSE-SU-2026:24469-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).\n\nChanges for expat:\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n","status":"published","published":"2026-10-27T16:12:58Z","modified":"2026-11-04T17:23:18.513414738Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2026:24554-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nChanges for expat:\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove \"harmless\" cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-27T14:41:39Z","modified":"2026-11-07T17:23:17.381879846Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"SUSE-SU-2026:4615-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-12T07:20:23Z","modified":"2026-10-13T10:30:04.873577795Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4619-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix a class of false positives where input should have been\n   rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n   earlier security fix (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n   and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n   dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-19T08:29:07Z","modified":"2026-10-19T09:43:18.179140646Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4623-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n  \n- CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584).\n- CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the\n  encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144).\n- CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496).\n- CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity\n  declaration value (bsc#1259726).\n- CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711).\n- CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition\n  (bsc#1259729).\n- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).\n- CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713).\n- CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a\n  policy violation (bsc#1267631).\n- CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within\n  handlers in cases of a policy violation (bsc#1268572).\n- CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573).\n- CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406,\n  CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410,\n  CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115).\n- CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts()\n  function (bsc#1275732).\n- CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same\n  as high surrogates during Unicode processing (bsc#1275594).\n- CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger\n  memory corruption (bsc#1275915).\n- CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860).\n- CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use-\n  after-free can occur (bsc#1275859).\n- CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334).\n- CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).\n- CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493).\n\nUpdate to 2.8.5 (jsc#PED-16154):\n\t\n * Bug fixes:\n * Fix an OOM-related memory leak on a failed overflow check\n * Fix memory alignment for architectures with 128bit pointers\n * Mark XML_SetHashSalt deprecated\n * CMake: only add /source-charset:utf-8 when /utf-8 is not present\n * lib: resolve undefined behavior from overshifting a signed int\n * lib: support read-only hash table lookup with non-zero-terminated\n keys\n * lib: use a C99 bool for ENTITY.open\n * version info bumped from 13:3:12 to 13:4:12\n * fix support for 2+ GiB documents (regression from 2.8.2)\n * reject empty version in the XML declaration\n * fix printf format for AIX\n * CMake|AIX: enable EXPAT_DEV_URANDOM by default\n * version info bumped from 13:2:12 to 13:3:12\n * Existing API function XML_SetHashSalt is now deprecated\n * because of its limitations, and its use should be\n * considered a vulnerability. Please either use the new API\n * function XML_SetHashSalt16Bytes (with known-high-quality\n * entropy input only!) instead, or leave the derivation of\n * a 16-bytes hash salt from high quality entropy to Expat's\n * internal machinery (by *not* calling either of the two\n * XML_SetHashSalt* functions).\n * xmlwf: Fix a memory leak\n * WASI: Fix format specifiers for 32bit WASI SDK\n * Fix alignment of internal allocations for some non-amd64\n architectures (e.g. sparc32); fixes up on the fix to\n CVE-2025-59375 (of Expat 2.7.2)\n * Fix a class of false positives where input should have been\n rejected with error XML_ERROR_ASYNC_ENTITY; regression from\n CVE-2024-8176 (of Expat 2.7.0)\n * Prove and regression-proof absence of integer overflow\n from function expat_realloc\n * Remove 'harmless' cast that truncated a size_t to unsigned\n * xmlwf: Resolve use of functions XML_GetErrorLineNumber\n and XML_GetErrorColumnNumber\n * CVE-2025-59375 -- Disallow use of disproportional amounts of\n dynamic memory from within an Expat parser\n * xmlwf: Fix (internal) help generator\n * xmlwf: Mention supported environment variables in\n","status":"published","published":"2026-10-12T07:27:49Z","modified":"2026-10-13T10:30:05.847197418Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4736-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\nUpdate to Mozilla Thunderbird 153.5 (MFSA 2026-110, bsc#1284493):\n\n- CVE-2026-109704: Privilege escalation in the Application Update component.\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the\n  Networking component.\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.\n- CVE-2026-109710: Use-after-free in the Graphics: Text component.\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.\n- CVE-2026-109713: Use-after-free in the Crash Reporting component.\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-109718: Use-after-free in the XML component.\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.\n- CVE-2026-109724: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109725: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109726: Use-after-free in the SVG component.\n- CVE-2026-109727: Use-after-free in the Audio/Video component.\n- CVE-2026-109728: Use-after-free in the DOM: Animation component.\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-109730: Integer overflow in the Graphics component.\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.\n- CVE-2026-109732: Use-after-free in the DOM: Streams component.\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component.\n- CVE-2026-109736: Frame poisoning in the Layout component.\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.\n- CVE-2026-109742: Information disclosure in the PDF Viewer component.\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component.\n- CVE-2026-109744: Other issue in the DOM: File component.\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.\n- CVE-2026-109751: Information disclosure in the Networking component.\n- CVE-2026-109752: Use-after-free in the DOM: Workers component.\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component.\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component.\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component.\n- CVE-2026-109759: Site isolation issue in the Networking component.\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component.\n- CVE-2026-109763: Mitigation bypass in the File Handling component.\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109767: Information disclosure in the Networking component.\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.\n- CVE-2026-109775: Denial-of-service in the WebRTC component.\n- CVE-2026-109776: Race condition in the XPCOM component.\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.\n- CVE-2026-109778: Privilege escalation in the WebExtensions component.\n- CVE-2026-109781: Denial-of-service in the Printing: Output component.\n- CVE-2026-109782: Mitigation bypass in the File Handling component.\n- CVE-2026-109783: Mitigation bypass in the File Handling component.\n- CVE-2026-110249: Denial-of-service in the Exchange email component.\n\nlibexpat updated:\n \n- CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in libexpat could lead to information disclosure, integrity loss, or denial of service (bsc#1275108).\n- CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for XML_ResumeParser in libexpat could lead to denial of service (bsc#1275108).\n- CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in libexpat could lead to denial of service or memory corruption (bsc#1275108).\n- CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in libexpat could lead to memory corruption (bsc#1275108).\n- CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could lead to memory corruption and potential security risks (bsc#1275108).\n- CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could lead to memory corruption (bsc#1275108).\n- CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to denial of service (bsc#1275108).\n- CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275108).\n- CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in libexpat could lead to denial of service or memory corruption (bsc#1275108).\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c (bsc#1275736).\n- CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing functions in libexpat allowed attackers to cause denial of service (bsc#1275605).\n- CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat allowed attackers to trigger memory corruption or a crash (bsc#1275736).\n- CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code in libexpat allowed attackers to cause a denial of service via hash flooding attacks (bsc#1275736).\n- CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with custom encoding callbacks in libexpat could lead to memory corruption (bsc#1275736).\n- CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat allowed attackers to pass unpaired surrogates or silently replace input characters (bsc#1282347).\n","status":"published","published":"2026-10-19T12:57:04Z","modified":"2026-10-20T10:45:04.190986882Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4806-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nFirefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):\n  \n- CVE-2026-109704: Privilege escalation in the Application Update component.\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the\n  Networking component.\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.\n- CVE-2026-109710: Use-after-free in the Graphics: Text component.\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.\n- CVE-2026-109713: Use-after-free in the Crash Reporting component.\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-109718: Use-after-free in the XML component.\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.\n- CVE-2026-109724: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109725: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109726: Use-after-free in the SVG component.\n- CVE-2026-109727: Use-after-free in the Audio/Video component.\n- CVE-2026-109728: Use-after-free in the DOM: Animation component.\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-109730: Integer overflow in the Graphics component.\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.\n- CVE-2026-109732: Use-after-free in the DOM: Streams component.\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component.\n- CVE-2026-109736: Frame poisoning in the Layout component.\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.\n- CVE-2026-109742: Information disclosure in the PDF Viewer component.\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component.\n- CVE-2026-109744: Other issue in the DOM: File component.\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.\n- CVE-2026-109751: Information disclosure in the Networking component.\n- CVE-2026-109752: Use-after-free in the DOM: Workers component.\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component.\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component.\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component.\n- CVE-2026-109759: Site isolation issue in the Networking component.\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component.\n- CVE-2026-109763: Mitigation bypass in the File Handling component.\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109767: Information disclosure in the Networking component.\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.\n- CVE-2026-109775: Denial-of-service in the WebRTC component.\n- CVE-2026-109776: Race condition in the XPCOM component.\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.\n- CVE-2026-109778: Privilege escalation in the WebExtensions component.\n- CVE-2026-109781: Denial-of-service in the Printing: Output component.\n- CVE-2026-109782: Mitigation bypass in the File Handling component.\n- CVE-2026-109783: Mitigation bypass in the File Handling component.\n\nlibexpat updated:\n    \n- CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in libexpat could lead to information disclosure, integrity loss, or denial of service (bsc#1275098).\n- CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for XML_ResumeParser in libexpat could lead to denial of service (bsc#1275098).\n- CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in libexpat could lead to denial of service or memory corruption (bsc#1275098).\n- CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in libexpat could lead to memory corruption (bsc#1275098).\n- CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could lead to memory corruption and potential security risks (bsc#1275098).\n- CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275098).\n- CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275098).\n- CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275098).\n- CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could lead to memory corruption (bsc#1275098).\n- CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275098).\n- CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to denial of service (bsc#1275098).\n- CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service (bsc#1275098).\n- CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in libexpat could lead to denial of service or memory corruption (bsc#1275098).\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c (bsc#1275736).\n- CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing functions in libexpat allowed attackers to cause denial of service (bsc#1275605).\n- CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat allowed attackers to trigger memory corruption or a crash (bsc#1275736).\n- CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code in libexpat allowed attackers to cause a denial of service via hash flooding attacks (bsc#1275736).\n- CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with custom encoding callbacks in libexpat could lead to memory corruption (bsc#1275736).\n- CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat allowed attackers to pass unpaired surrogates or silently replace input characters (bsc#1282347).\n","status":"published","published":"2026-10-21T08:01:36Z","modified":"2026-10-21T20:02:16.0687972Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4834-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\nFirefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):\n\n- CVE-2026-109704: Privilege escalation in the Application Update component.\n- CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the\n  Networking component.\n- CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.\n- CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.\n- CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.\n- CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.\n- CVE-2026-109710: Use-after-free in the Graphics: Text component.\n- CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.\n- CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.\n- CVE-2026-109713: Use-after-free in the Crash Reporting component.\n- CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.\n- CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.\n- CVE-2026-109718: Use-after-free in the XML component.\n- CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.\n- CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.\n- CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.\n- CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.\n- CVE-2026-109724: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109725: Use-after-free in the DOM: Core \u0026 HTML component.\n- CVE-2026-109726: Use-after-free in the SVG component.\n- CVE-2026-109727: Use-after-free in the Audio/Video component.\n- CVE-2026-109728: Use-after-free in the DOM: Animation component.\n- CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.\n- CVE-2026-109730: Integer overflow in the Graphics component.\n- CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.\n- CVE-2026-109732: Use-after-free in the DOM: Streams component.\n- CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.\n- CVE-2026-109734: Mitigation bypass in the DOM: Security component.\n- CVE-2026-109736: Frame poisoning in the Layout component.\n- CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.\n- CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.\n- CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.\n- CVE-2026-109742: Information disclosure in the PDF Viewer component.\n- CVE-2026-109743: Privilege escalation in the Panning and Zooming component.\n- CVE-2026-109744: Other issue in the DOM: File component.\n- CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.\n- CVE-2026-109751: Information disclosure in the Networking component.\n- CVE-2026-109752: Use-after-free in the DOM: Workers component.\n- CVE-2026-109753: Incorrect boundary conditions in the Layout component.\n- CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.\n- CVE-2026-109756: Privilege escalation in the DOM: Navigation component.\n- CVE-2026-109757: Sandbox escape due to race condition in the Networking component.\n- CVE-2026-109759: Site isolation issue in the Networking component.\n- CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.\n- CVE-2026-109762: Incorrect boundary conditions in the SVG component.\n- CVE-2026-109763: Mitigation bypass in the File Handling component.\n- CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.\n- CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.\n- CVE-2026-109767: Information disclosure in the Networking component.\n- CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.\n- CVE-2026-109775: Denial-of-service in the WebRTC component.\n- CVE-2026-109776: Race condition in the XPCOM component.\n- CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.\n- CVE-2026-109778: Privilege escalation in the WebExtensions component.\n- CVE-2026-109781: Denial-of-service in the Printing: Output component.\n- CVE-2026-109782: Mitigation bypass in the File Handling component.\n- CVE-2026-109783: Mitigation bypass in the File Handling component.\n\nlibexpat updated:\n    \n- CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value. (bsc#1259727)\n- CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing. (bsc#1259712)\n- CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory condition. (bsc#1259730)\n- CVE-2026-41080: libexpat: insufficient entropy, and thus hash flooding can occur via a crafted XML document. (bsc#1262263)\n- CVE-2026-45186: libexpat: computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. (bsc#1264713)\n- CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in libexpat could lead to information disclosure, integrity loss, or denial of service. (bsc#1275098)\n- CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for XML_ResumeParser in libexpat could lead to denial of service. (bsc#1275098)\n- CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in libexpat could lead to denial of service or memory corruption. (bsc#1275098)\n- CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in libexpat could lead to memory corruption. (bsc#1275098)\n- CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could lead to memory corruption and potential security risks. (bsc#1275098)\n- CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could lead to memory corruption. (bsc#1275098)\n- CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to denial of service. (bsc#1275098)\n- CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)\n- CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in libexpat could lead to denial of service or memory corruption. (bsc#1275098)\n- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c. (bsc#1275736)\n- CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing functions in libexpat allowed attackers to cause denial of service. (bsc#1275605)\n- CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat allowed attackers to trigger memory corruption or a crash. (bsc#1275736)\n- CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code in libexpat allowed attackers to cause a denial of service via hash flooding attacks. (bsc#1275736)\n- CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with custom encoding callbacks in libexpat could lead to memory corruption. (bsc#1275736)\n- CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat allowed attackers to pass unpaired surrogates or silently replace input characters. (bsc#1282347)\n","status":"published","published":"2026-10-21T12:51:17Z","modified":"2026-10-22T11:45:03.861208944Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8790-1","title":"expat vulnerabilities","description":"It was discovered that Expat could be made to allocate large amounts of\nmemory when parsing a small crafted document. An attacker could possibly\nuse this issue to cause Expat to consume resources, leading to a denial of\nservice. This issue was only addressed in Ubuntu 24.04 LTS.\n(CVE-2025-59375)\n\nIt was discovered that Expat incorrectly handled empty external parameter\nentity content. An attacker could possibly use this issue to cause Expat to\ncrash, resulting in a denial of service. (CVE-2026-32776)\n\nIt was discovered that Expat incorrectly handled certain DTD content. An\nattacker could possibly use this issue to cause Expat to enter an infinite\nloop, resulting in a denial of service. (CVE-2026-32777)\n\nIt was discovered that Expat incorrectly handled memory when retrying after\nan earlier out-of-memory condition. An attacker could possibly use this\nissue to cause Expat to crash, resulting in a denial of service.\n(CVE-2026-32778)\n\nIt was discovered that Expat performed attribute name collision checks\ninefficiently. An attacker could possibly use this issue to cause Expat to\nconsume resources when processing a moderately sized crafted XML document,\nresulting in a denial of service.  This issue was only addressed in Ubuntu\n24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-45186)\n\nIt was discovered that Expat used insufficient entropy, allowing hash\nflooding through a crafted XML document. An attacker could possibly use\nthis issue to cause Expat to consume resources, leading to a denial of\nservice.  This issue was only addressed in Ubuntu 14.04 LTS, Ubuntu 24.04\nLTS, and Ubuntu 26.04 LTS. (CVE-2026-41080)\n\nIt was discovered that Expat did not track handler call depth for certain\nfunctions called from within handlers, leading to a use-after-free. An\nattacker could possibly use this issue to cause Expat to crash, resulting\nin a denial of service, or possibly execute arbitrary code.\n(CVE-2026-50219, CVE-2026-56412)\n\nIt was discovered that Expat incorrectly handled certain values, leading to\ninteger overflows. An attacker could possibly use this issue to cause Expat\nto crash, resulting in a denial of service. (CVE-2026-56403,\nCVE-2026-56404, CVE-2026-56405)\n\nIt was discovered that Expat incorrectly handled certain values, leading to\nan integer overflow. An attacker could possibly use this issue to cause\nExpat to crash, resulting in a denial of service. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and\nUbuntu 26.04 LTS. (CVE-2026-56408)","status":"published","published":"2026-09-21T13:50:42Z","modified":"2026-09-22T03:27:36.575298644Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}