From patchwork Wed Aug 12 21:06:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10137 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hL1KH4JCnz3wbG for ; Wed, 12 Aug 2026 21:07:31 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hL1K72zDsz7MS for ; Wed, 12 Aug 2026 21:07:23 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hL1J35FWQz36h9 for ; Wed, 12 Aug 2026 21:06:27 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hL1J110fwz2xHk for ; Wed, 12 Aug 2026 21:06:25 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hL1Hr43RKz1F9; Wed, 12 Aug 2026 21:06:16 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1786568776; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ar7k4hGA4Bq5yJuCeyBUw+U+pRPmLPcDj0irFxEKZWY=; b=0YppNUROo0o1zbv9KvhDD/oDpT8BP9/uzb6zzkNbuUSMAmQHUktsNcaChug5BAsDgOe4ES Z8SXkoiZCFiYDlCg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1786568776; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ar7k4hGA4Bq5yJuCeyBUw+U+pRPmLPcDj0irFxEKZWY=; b=fau7xzhdKundbRCogq6xPyCKkMLy0Py6zpTBPGnZmvbLe0pgSm5aTjt7d8300M8m8aB9Pb i4MkJCFg3pvLOFJA4fPoXuoxuW05p5HAR40yPi3lBrZoJMkg6HAJOyqhEL4mwYgKdkjien JlHAtTEQ9is4G6Pzc2gdtAlFYisHFGerHsHTIUTCIPw++jgprlWcF2IIlwb/HG8sPrg0IO Wwf7io0dirh8S/VCZfPfVBXmOnUagYTFto+lpKXgrUwlXS5ZvSqRWwXcGkKoNVz/XMZ8g2 Qu8zMO63JT3PM2kENrU5aMDKueC6c4B8xNUryYlRO8mKTYJVAsAxdtGHevdcWg== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] expat: Update to version 2.8.3 Date: Wed, 12 Aug 2026 23:06:05 +0200 Message-ID: <20260812210605.3663404-2-adolf.belka@ipfire.org> In-Reply-To: <20260812210605.3663404-1-adolf.belka@ipfire.org> References: <20260812210605.3663404-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 2.8.2 to 2.8.3 - Update of rootfile - 1 CVE fix - Changelog 2.8.3 Security fixes: #1296 CVE-2026-72522 -- Fix an out-of-bounds read and the resulting infinite loop caused by treating low surrogates (Unicode) the same as high surrogates in functions *_toUtf16. Needs Expat compiled with 16bit character support (e.g. with Firefox and/or on Windows) to be affected. Upstream CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) (Note the "AV:N" for network/remote, the "AV:L" in NVD by Mitre is mistaken.) Original bug report from Mozilla at: https://bugzilla.mozilla.org/show_bug.cgi?id=2053153 Bug fixes: #1297 #1300 lib: Fix support for 2+ GiB documents (regression from 2.8.2) #1286 lib: Reject empty version in the XML declaration #1305 #1306 lib: Fix printf format for AIX Other changes: #1309 CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX #1295 CMake|Windows: Add a 64bit MinGW toolchain file #1287 #1289 CMake|Windows: Start invoking MSVC with /source-charset:utf-8 #1289 CMake|Windows: Start requiring MSVC 2015 Update 2 or later #1300 Document the current wrap-around issues with functions - XML_GetCurrentByteIndex - XML_GetCurrentColumnNumber - XML_GetCurrentLineNumber - XML_GetAttributeInfo explicitly. #1303 Address Clang Static Analyzer 22 warning `core.NullPointerArithm` #1313 #1314 Version info bumped from 13:2:12 (libexpat*.so.1.12.2) to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/ for what these numbers do Infrastructure: #1311 CI: Limit workflow runtime and package installation runtime #1310 CI: Pin Cppcheck version for a robust CI #1310 CI: Migrate Cppcheck CI from macOS to Linux #1312 CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten and WASI SDK #1304 CI: Activate AddressSanitizer for MSVC Windows CI #1308 CI: Introduce zizmor static analysis for GitHub Actions #1308 CI: Start using `persist-credentials: false` with Git checkout #1219 CI: Add a 7 day cooldown to Dependabot for GitHub Actions #1302 #1303 CI: Bump Clang from 21 to 22 #1293 #1294 Update project status for 2026-08 #1301 #1307 Add SPDX license identifiers to the source code Signed-off-by: Adolf Belka --- config/rootfiles/common/expat | 20 ++++++++++---------- lfs/expat | 4 ++-- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/config/rootfiles/common/expat b/config/rootfiles/common/expat index 0f15469d3..298882d6e 100644 --- a/config/rootfiles/common/expat +++ b/config/rootfiles/common/expat @@ -2,21 +2,21 @@ #usr/include/expat.h #usr/include/expat_config.h #usr/include/expat_external.h -#usr/lib/cmake/expat-2.8.2 -#usr/lib/cmake/expat-2.8.2/expat-config-version.cmake -#usr/lib/cmake/expat-2.8.2/expat-config.cmake -#usr/lib/cmake/expat-2.8.2/expat-noconfig.cmake -#usr/lib/cmake/expat-2.8.2/expat.cmake +#usr/lib/cmake/expat-2.8.3 +#usr/lib/cmake/expat-2.8.3/expat-config-version.cmake +#usr/lib/cmake/expat-2.8.3/expat-config.cmake +#usr/lib/cmake/expat-2.8.3/expat-noconfig.cmake +#usr/lib/cmake/expat-2.8.3/expat.cmake #usr/lib/libexpat.la #usr/lib/libexpat.so usr/lib/libexpat.so.1 -usr/lib/libexpat.so.1.12.2 +usr/lib/libexpat.so.1.12.3 #usr/lib/pkgconfig/expat.pc #usr/share/doc/expat -#usr/share/doc/expat-2.8.2 -#usr/share/doc/expat-2.8.2/ok.min.css -#usr/share/doc/expat-2.8.2/reference.html -#usr/share/doc/expat-2.8.2/style.css +#usr/share/doc/expat-2.8.3 +#usr/share/doc/expat-2.8.3/ok.min.css +#usr/share/doc/expat-2.8.3/reference.html +#usr/share/doc/expat-2.8.3/style.css #usr/share/doc/expat/AUTHORS #usr/share/doc/expat/changelog #usr/share/man/man1/xmlwf.1 diff --git a/lfs/expat b/lfs/expat index 480d98b65..2fb5e7a72 100644 --- a/lfs/expat +++ b/lfs/expat @@ -24,7 +24,7 @@ include Config -VER = 2.8.2 +VER = 2.8.3 THISAPP = expat-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = f037cb75f86652fbddd3474f2b7a1293e9b77b540475fa34432a8304ddc58b3eafbab5150a5b591fc4a889d895507b0d379032cdd0c474445ac0aa9e518bef18 +$(DL_FILE)_BLAKE2 = 4dc1173f3458320278b6776aa9342aec4eec3e2e5d8806e52dec59b9a40d5fdad5b8930708bace06a5c9a33fd7451df67c5c822954fa3d7f763babab62989390 install : $(TARGET)