expat: Update to version 2.8.3
Commit Message
- Update from version 2.8.2 to 2.8.3
- Update of rootfile
- 1 CVE fix
- Changelog
2.8.3
Security fixes:
#1296 CVE-2026-72522 -- Fix an out-of-bounds read and the resulting
infinite loop caused by treating low surrogates (Unicode)
the same as high surrogates in functions *_toUtf16.
Needs Expat compiled with 16bit character support
(e.g. with Firefox and/or on Windows) to be affected.
Upstream CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
(Note the "AV:N" for network/remote, the "AV:L" in NVD by
Mitre is mistaken.)
Original bug report from Mozilla at:
https://bugzilla.mozilla.org/show_bug.cgi?id=2053153
Bug fixes:
#1297 #1300 lib: Fix support for 2+ GiB documents (regression from 2.8.2)
#1286 lib: Reject empty version in the XML declaration
#1305 #1306 lib: Fix printf format for AIX
Other changes:
#1309 CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX
#1295 CMake|Windows: Add a 64bit MinGW toolchain file
#1287 #1289 CMake|Windows: Start invoking MSVC with /source-charset:utf-8
#1289 CMake|Windows: Start requiring MSVC 2015 Update 2 or later
#1300 Document the current wrap-around issues with functions
- XML_GetCurrentByteIndex
- XML_GetCurrentColumnNumber
- XML_GetCurrentLineNumber
- XML_GetAttributeInfo
explicitly.
#1303 Address Clang Static Analyzer 22 warning
`core.NullPointerArithm`
#1313 #1314 Version info bumped from 13:2:12 (libexpat*.so.1.12.2)
to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/
for what these numbers do
Infrastructure:
#1311 CI: Limit workflow runtime and package installation runtime
#1310 CI: Pin Cppcheck version for a robust CI
#1310 CI: Migrate Cppcheck CI from macOS to Linux
#1312 CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten
and WASI SDK
#1304 CI: Activate AddressSanitizer for MSVC Windows CI
#1308 CI: Introduce zizmor static analysis for GitHub Actions
#1308 CI: Start using `persist-credentials: false` with Git checkout
#1219 CI: Add a 7 day cooldown to Dependabot for GitHub Actions
#1302 #1303 CI: Bump Clang from 21 to 22
#1293 #1294 Update project status for 2026-08
#1301 #1307 Add SPDX license identifiers to the source code
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/common/expat | 20 ++++++++++----------
lfs/expat | 4 ++--
2 files changed, 12 insertions(+), 12 deletions(-)
@@ -2,21 +2,21 @@
#usr/include/expat.h
#usr/include/expat_config.h
#usr/include/expat_external.h
-#usr/lib/cmake/expat-2.8.2
-#usr/lib/cmake/expat-2.8.2/expat-config-version.cmake
-#usr/lib/cmake/expat-2.8.2/expat-config.cmake
-#usr/lib/cmake/expat-2.8.2/expat-noconfig.cmake
-#usr/lib/cmake/expat-2.8.2/expat.cmake
+#usr/lib/cmake/expat-2.8.3
+#usr/lib/cmake/expat-2.8.3/expat-config-version.cmake
+#usr/lib/cmake/expat-2.8.3/expat-config.cmake
+#usr/lib/cmake/expat-2.8.3/expat-noconfig.cmake
+#usr/lib/cmake/expat-2.8.3/expat.cmake
#usr/lib/libexpat.la
#usr/lib/libexpat.so
usr/lib/libexpat.so.1
-usr/lib/libexpat.so.1.12.2
+usr/lib/libexpat.so.1.12.3
#usr/lib/pkgconfig/expat.pc
#usr/share/doc/expat
-#usr/share/doc/expat-2.8.2
-#usr/share/doc/expat-2.8.2/ok.min.css
-#usr/share/doc/expat-2.8.2/reference.html
-#usr/share/doc/expat-2.8.2/style.css
+#usr/share/doc/expat-2.8.3
+#usr/share/doc/expat-2.8.3/ok.min.css
+#usr/share/doc/expat-2.8.3/reference.html
+#usr/share/doc/expat-2.8.3/style.css
#usr/share/doc/expat/AUTHORS
#usr/share/doc/expat/changelog
#usr/share/man/man1/xmlwf.1
@@ -24,7 +24,7 @@
include Config
-VER = 2.8.2
+VER = 2.8.3
THISAPP = expat-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = f037cb75f86652fbddd3474f2b7a1293e9b77b540475fa34432a8304ddc58b3eafbab5150a5b591fc4a889d895507b0d379032cdd0c474445ac0aa9e518bef18
+$(DL_FILE)_BLAKE2 = 4dc1173f3458320278b6776aa9342aec4eec3e2e5d8806e52dec59b9a40d5fdad5b8930708bace06a5c9a33fd7451df67c5c822954fa3d7f763babab62989390
install : $(TARGET)