openSUSE-SU-2026:21945-1

This update for expat fixes the following issues:

• CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
• CVE-2026-45186: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input (bsc#1264713).
• CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation (bsc#1267631).
• CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572).
• CVE-2026-56132: mishandled memory reallocation during array scaffolding in doProlog can cause heap-based buffer overflows (bsc#1268573).
• CVE-2026-56403: integer overflow in the storeAtts function can cause memory corruption and potential arbitrary code execution (bsc#1275096).
• CVE-2026-56404: integer overflow in the addBinding function can cause undersized memory allocations, memory corruption, and application crashes (bsc#1275096).
• CVE-2026-56405: integer overflow in the getAttributeId function can cause heap memory corruption and arbitrary code execution (bsc#1275096).
• CVE-2026-56406: missing bounds validation in XML_ParseBuffer can cause integer overflows, memory corruption, and application crashes (bsc#1275096).
• CVE-2026-56407: integer overflow in doProlog related to entity text length can cause memory corruption and denial of service (bsc#1275096).
• CVE-2026-56408: integer overflow in the copyString function can cause heap memory corruption and application crashes (bsc#1275096).
• CVE-2026-56409: integer overflow in the xmlwf utility output filename handling can allow path buffer corruption and arbitrary file write conditions (bsc#1275096).
• CVE-2026-56410: integer overflow in resolveSystemId within the xmlwf utility can cause memory corruption, information disclosure, and potential code execution (bsc#1275096).
• CVE-2026-56411: integer overflow in endDoctypeDecl via NOTATION declarations in xmlwf can cause memory corruption and denial of service (bsc#1275096).
• CVE-2026-56412: incomplete handler call depth tracking in doCdataSection can cause use-after-free conditions and arbitrary code execution (bsc#1275096).
• CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c (bsc#1275732).
• CVE-2026-72522: libexpat: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594).
• CVE-2026-76641: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915).
• CVE-2026-76956: In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted X (bsc#1275860).
• CVE-2026-76957: libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. (bsc#1275859).

Changes for expat:

• Updated to version 2.8.4