Source Package: expat (2.9.0-1~deb13u1)
XML parsing C library - runtime library
The following binary packages are built from this source package:
- libexpat1
XML parsing C library - runtime library
- libexpat1-dev
XML parsing C library - development kit
Packages / Debian 13 (Trixie) / Source / libs / expat
Bekannte Sicherheitslücken
Die Paketzuordnung läuft.
| CVE | Schweregrad | Betroffene Versionen |
|---|---|---|
| [CVE-2026-115506] expat: CVE-2026-115506 | High(8.7) | BetroffenDetails (4)
|
| [CVE-2026-77214] expat: CVE-2026-77214 | High(8.3) | BetroffenDetails (4)
|
| [CVE-2026-102633] libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to ap | High(8.2) | BetroffenDetails (4)
|
| [CVE-2026-72522] libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions. | High(8.7) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-56411] xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. | High(8.7) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-56410] xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. | High(8.7) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-56409] xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. | High(8.7) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-56407] libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. | High(8.7) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-56406] libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. | High(8.7) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-56131] libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-502 | High(8.7) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-56132] In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. | High(8.7) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-50219] libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. | Medium(6.9) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-56403] libexpat before 2.8.2 has an integer overflow in storeAtts. | Medium(6.9) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-56404] libexpat before 2.8.2 has an integer overflow in addBinding. | Medium(6.9) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-56405] libexpat before 2.8.2 has an integer overflow in getAttributeId. | Medium(6.9) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-56408] libexpat before 2.8.2 has an integer overflow in copyString. | Medium(6.9) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-56412] libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a u | Medium(6.9) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-45186] In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-41080] libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. | Medium(6.9) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
| [CVE-2026-32776] Expat vulnerabilities | High(7.5) | Unbekannt Die Paketzuordnung läuft. Beobachtet: Details (4)
|
Zuletzt synchronisiert:
Quellen
- Debian 13 (Trixie) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-main-amd64:3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Repository-signature verification record- Signed object
- https://deb.debian.org/debian/dists/trixie/InRelease
- Signed-object SHA-256
- 98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
- Observed SHA-256
- 3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
- Result
- match verified
- Debian 13 (Trixie) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-main-arm64:753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Repository-signature verification record- Signed object
- https://deb.debian.org/debian/dists/trixie/InRelease
- Signed-object SHA-256
- 98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- 753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
- Observed SHA-256
- 753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
- Result
- match verified
- Debian 13 (Trixie) security main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-security-main-arm64:a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
Repository-signature verification record- Signed-object SHA-256
- fb4f5284b755510aafc1d8a39ef966c7ef714aaab3ecc24baae0a67c38518ab5
- Signer fingerprint
- B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
- Observed SHA-256
- a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
- Result
- match verified
- Debian SecurityOct 16, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-security-main-amd64:36b028d823650c895dcd0dd43275d4345d26859524f41b95f8b629b310c21b4b
Repository-signature verification record- Signed-object SHA-256
- 6d82f4cefa55efd8a2d0a994bd4d957c961fbcd32006344919e05d45e81a02aa
- Signer fingerprint
- B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Oct 16, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 36b028d823650c895dcd0dd43275d4345d26859524f41b95f8b629b310c21b4b
- Observed SHA-256
- 36b028d823650c895dcd0dd43275d4345d26859524f41b95f8b629b310c21b4b
- Result
- match verified
- Debian SecurityOct 24, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-security-main-amd64:80abc7ace801ccb58732fe448148850e3078f925942b034fe532c371f804c2a0
Repository-signature verification record- Signed-object SHA-256
- 2dc86861c04386d3c511340d4f011a37acfd1cccdf3dbd3e054d6fe8e4118ebc
- Signer fingerprint
- B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Oct 24, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 80abc7ace801ccb58732fe448148850e3078f925942b034fe532c371f804c2a0
- Observed SHA-256
- 80abc7ace801ccb58732fe448148850e3078f925942b034fe532c371f804c2a0
- Result
- match verified
- Debian SecurityAug 17, 2026
Authoritative source; repository metadata signature verified
Signaturnachweis
trixie-security-main-amd64:f00ce6713f8e3ebfd8cb206ecf0676610269733270e99c6c2bd5cc9bf784227e
Repository-signature verification record- Signed-object SHA-256
- c862b5c7c588459c952a3bd7d951785d5996e189ebad7a6bc6efde4dab474892
- Signer fingerprint
- B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Aug 18, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- f00ce6713f8e3ebfd8cb206ecf0676610269733270e99c6c2bd5cc9bf784227e
- Observed SHA-256
- f00ce6713f8e3ebfd8cb206ecf0676610269733270e99c6c2bd5cc9bf784227e
- Result
- match verified