expat: Update to version 2.8.4
Commit Message
- Update from version 2.8.3 to 2.8.4
- Update of rootfile
- 4 CVE fixes
- Changelog
2.8.4
Security fixes:
#1321 #1331 CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from
"attribute isCdata lookups" that allowed denial of service
attacks through moderately sized crafted XML input
(CWE-407).
The vulnerability is closely related to past CVE-2026-45186
that was fixed with Expat 2.8.1.
Please note that a layer of compression around XML can
significantly reduce the minimum attack payload size.
Upstream CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
(Note the "AV:N" for network/remote.)
#1322 CVE-2026-76957 -- Protect custom encoding callbacks from
parser re-entry. The vulnerability is closely related to
past issues CVE-2026-50219, CVE-2026-56131 and
CVE-2026-56412 that were all fixed with Expat 2.8.2.
#1326 CVE-2026-76956 -- Fix inverted getentropy() return handling
Allows for hash flooding denial of services in
configurations where getentropy is configured or detected
as the only high quality entropy extractor.
Upstream CVSS 3.1 vector:
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 5.9)
(Note the "AV:N" for network/remote.)
Other changes:
#1332 #1333 CMake: Only add `/source-charset:utf-8` when `/utf-8` is not
present
#1315 lib: Resolve (currently unreachable) undefined behavior from
overshifting a signed int to the left
#1325 #1334 lib: Support read-only hash table lookup with keys that are
not zero-terminated
#1340 lib: Use a C99 bool for `ENTITY.open`
#1319 Fix typo in comment
#1320 Sync file headers
#1328 #1329 Version info bumped from 13:3:12 (libexpat*.so.1.12.3)
to 13:4:12 (libexpat*.so.1.12.4); see https://verbump.de/
for what these numbers do
Infrastructure:
#1317 #1335 CI: Cover compilation and execution with Fil-C
#1337 CI: Cover compilation and execution on riscv64
#1338 CI: Cover compilation and execution with Clang-based MinGW
#1339 CI: Cover compilation and execution on (big-endian) s390x
#1316 CI: Run test suite with musl, also
#1336 CI: Bump WASI SDK from 33 to 34
#1345 CI: Bump Clang from 22 to 23
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/common/expat | 20 ++++++++++----------
lfs/expat | 4 ++--
2 files changed, 12 insertions(+), 12 deletions(-)
@@ -2,21 +2,21 @@
#usr/include/expat.h
#usr/include/expat_config.h
#usr/include/expat_external.h
-#usr/lib/cmake/expat-2.8.3
-#usr/lib/cmake/expat-2.8.3/expat-config-version.cmake
-#usr/lib/cmake/expat-2.8.3/expat-config.cmake
-#usr/lib/cmake/expat-2.8.3/expat-noconfig.cmake
-#usr/lib/cmake/expat-2.8.3/expat.cmake
+#usr/lib/cmake/expat-2.8.4
+#usr/lib/cmake/expat-2.8.4/expat-config-version.cmake
+#usr/lib/cmake/expat-2.8.4/expat-config.cmake
+#usr/lib/cmake/expat-2.8.4/expat-noconfig.cmake
+#usr/lib/cmake/expat-2.8.4/expat.cmake
#usr/lib/libexpat.la
#usr/lib/libexpat.so
usr/lib/libexpat.so.1
-usr/lib/libexpat.so.1.12.3
+usr/lib/libexpat.so.1.12.4
#usr/lib/pkgconfig/expat.pc
#usr/share/doc/expat
-#usr/share/doc/expat-2.8.3
-#usr/share/doc/expat-2.8.3/ok.min.css
-#usr/share/doc/expat-2.8.3/reference.html
-#usr/share/doc/expat-2.8.3/style.css
+#usr/share/doc/expat-2.8.4
+#usr/share/doc/expat-2.8.4/ok.min.css
+#usr/share/doc/expat-2.8.4/reference.html
+#usr/share/doc/expat-2.8.4/style.css
#usr/share/doc/expat/AUTHORS
#usr/share/doc/expat/changelog
#usr/share/man/man1/xmlwf.1
@@ -24,7 +24,7 @@
include Config
-VER = 2.8.3
+VER = 2.8.4
THISAPP = expat-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 4dc1173f3458320278b6776aa9342aec4eec3e2e5d8806e52dec59b9a40d5fdad5b8930708bace06a5c9a33fd7451df67c5c822954fa3d7f763babab62989390
+$(DL_FILE)_BLAKE2 = bec06d3c3179115692edb5e9366412361abae5355b131a005ef91aaa041bf4ebf74a86cc2fac29c44730a07cba6fbda988a6bfdafafc9eeba25a00fb98e43d24
install : $(TARGET)