From patchwork Tue Sep 8 19:52:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10175 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hfZNs5FPRz3wqL for ; Tue, 08 Sep 2026 19:53:01 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hfZNq38LKz6tl for ; Tue, 08 Sep 2026 19:52:59 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hfZNl4fm8z377G for ; Tue, 08 Sep 2026 19:52:55 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hfZNc1386z36W9 for ; Tue, 08 Sep 2026 19:52:48 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hfZNb2Dgfz6m4; Tue, 08 Sep 2026 19:52:47 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1788897167; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wWxG5y396TktNlhecwb/W9ld/5a8MC+HpJHOtUuC2sw=; b=S0Co6YLxBnQ/jKwddridaA43+H+B+OBCGOLpSud0U9ZiN5QBxVtDCfBtCqE8BDDLI1zfYm KQxKEHnXBhOQFSDw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1788897167; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wWxG5y396TktNlhecwb/W9ld/5a8MC+HpJHOtUuC2sw=; b=jNcrlLZZ18OsNymwxUrFIYwgSLTeW/W8ers/+Sfh59DJny7TM36a6V35tpDVYtPCatJJnb UcLVvBwDK0NUNNy4ac/zot9PuEnQXZr9wPx6S5qgKlQXak/CoegLf8goHRqsmuyXBQ//SY PjS+GN/Dhx67bTfqOTIB6NysKAinjvB/YoWSg0io/eR0W+U3Fu/BVsVEOCNI1OPOX25tkn 9APvgLasjGGRXa7JRbL0er5kqUGHwG8z1LLCMPzts8wK5W0FCjlA2uEzF/dovUrdH5DcpA D3gGkQ89/rR0gRvoWBxWlvxjWpob440VerOhtVoL3FDSoF/4PFok9cxxVchVTQ== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] expat: Update to version 2.8.4 Date: Tue, 8 Sep 2026 21:52:34 +0200 Message-ID: <20260908195241.2909132-8-adolf.belka@ipfire.org> In-Reply-To: <20260908195241.2909132-1-adolf.belka@ipfire.org> References: <20260908195241.2909132-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 2.8.3 to 2.8.4 - Update of rootfile - 4 CVE fixes - Changelog 2.8.4 Security fixes: #1321 #1331 CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from "attribute isCdata lookups" that allowed denial of service attacks through moderately sized crafted XML input (CWE-407). The vulnerability is closely related to past CVE-2026-45186 that was fixed with Expat 2.8.1. Please note that a layer of compression around XML can significantly reduce the minimum attack payload size. Upstream CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) (Note the "AV:N" for network/remote.) #1322 CVE-2026-76957 -- Protect custom encoding callbacks from parser re-entry. The vulnerability is closely related to past issues CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412 that were all fixed with Expat 2.8.2. #1326 CVE-2026-76956 -- Fix inverted getentropy() return handling Allows for hash flooding denial of services in configurations where getentropy is configured or detected as the only high quality entropy extractor. Upstream CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 5.9) (Note the "AV:N" for network/remote.) Other changes: #1332 #1333 CMake: Only add `/source-charset:utf-8` when `/utf-8` is not present #1315 lib: Resolve (currently unreachable) undefined behavior from overshifting a signed int to the left #1325 #1334 lib: Support read-only hash table lookup with keys that are not zero-terminated #1340 lib: Use a C99 bool for `ENTITY.open` #1319 Fix typo in comment #1320 Sync file headers #1328 #1329 Version info bumped from 13:3:12 (libexpat*.so.1.12.3) to 13:4:12 (libexpat*.so.1.12.4); see https://verbump.de/ for what these numbers do Infrastructure: #1317 #1335 CI: Cover compilation and execution with Fil-C #1337 CI: Cover compilation and execution on riscv64 #1338 CI: Cover compilation and execution with Clang-based MinGW #1339 CI: Cover compilation and execution on (big-endian) s390x #1316 CI: Run test suite with musl, also #1336 CI: Bump WASI SDK from 33 to 34 #1345 CI: Bump Clang from 22 to 23 Signed-off-by: Adolf Belka --- config/rootfiles/common/expat | 20 ++++++++++---------- lfs/expat | 4 ++-- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/config/rootfiles/common/expat b/config/rootfiles/common/expat index 298882d6e..575cbe1cb 100644 --- a/config/rootfiles/common/expat +++ b/config/rootfiles/common/expat @@ -2,21 +2,21 @@ #usr/include/expat.h #usr/include/expat_config.h #usr/include/expat_external.h -#usr/lib/cmake/expat-2.8.3 -#usr/lib/cmake/expat-2.8.3/expat-config-version.cmake -#usr/lib/cmake/expat-2.8.3/expat-config.cmake -#usr/lib/cmake/expat-2.8.3/expat-noconfig.cmake -#usr/lib/cmake/expat-2.8.3/expat.cmake +#usr/lib/cmake/expat-2.8.4 +#usr/lib/cmake/expat-2.8.4/expat-config-version.cmake +#usr/lib/cmake/expat-2.8.4/expat-config.cmake +#usr/lib/cmake/expat-2.8.4/expat-noconfig.cmake +#usr/lib/cmake/expat-2.8.4/expat.cmake #usr/lib/libexpat.la #usr/lib/libexpat.so usr/lib/libexpat.so.1 -usr/lib/libexpat.so.1.12.3 +usr/lib/libexpat.so.1.12.4 #usr/lib/pkgconfig/expat.pc #usr/share/doc/expat -#usr/share/doc/expat-2.8.3 -#usr/share/doc/expat-2.8.3/ok.min.css -#usr/share/doc/expat-2.8.3/reference.html -#usr/share/doc/expat-2.8.3/style.css +#usr/share/doc/expat-2.8.4 +#usr/share/doc/expat-2.8.4/ok.min.css +#usr/share/doc/expat-2.8.4/reference.html +#usr/share/doc/expat-2.8.4/style.css #usr/share/doc/expat/AUTHORS #usr/share/doc/expat/changelog #usr/share/man/man1/xmlwf.1 diff --git a/lfs/expat b/lfs/expat index 2fb5e7a72..512cb5a76 100644 --- a/lfs/expat +++ b/lfs/expat @@ -24,7 +24,7 @@ include Config -VER = 2.8.3 +VER = 2.8.4 THISAPP = expat-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 4dc1173f3458320278b6776aa9342aec4eec3e2e5d8806e52dec59b9a40d5fdad5b8930708bace06a5c9a33fd7451df67c5c822954fa3d7f763babab62989390 +$(DL_FILE)_BLAKE2 = bec06d3c3179115692edb5e9366412361abae5355b131a005ef91aaa041bf4ebf74a86cc2fac29c44730a07cba6fbda988a6bfdafafc9eeba25a00fb98e43d24 install : $(TARGET)