[Midnightbsd-cvs] [MidnightBSD/src] 4e48f4: Import expat 2.8.4 (trimmed)

[Lucas Holt]

  Branch: refs/heads/vendor/expat/dist
  Home:   https://github.com/MidnightBSD/src
  Commit: 4e48f4b395b6962c8ffcd8f23cbcd1b8c958a4b2
      https://github.com/MidnightBSD/src/commit/4e48f4b395b6962c8ffcd8f23cbcd1b8c958a4b2
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-01 (Tue, 01 Sep 2026)

  Changed paths:
    M Changes
    M README.md
    M configure.ac
    M doc/reference.html
    M doc/xmlwf.1
    M doc/xmlwf.xml
    M fix-xmltest-log.sh
    M lib/expat.h
    M lib/internal.h
    M lib/random_getentropy.c
    M lib/xmlparse.c
    M lib/xmltok.h
    M tests/basic_tests.c
    M tests/misc_tests.c

  Log Message:
  -----------
  Import expat 2.8.4 (trimmed)

Security fixes:

CVE-2026-66046, CVE-2026-76641 -- quadratic runtime in attribute
"isCdata" lookups allowing denial of service through moderately sized
crafted XML input (CWE-407).  Default attribute lookups now go through
a hash table instead of a linear scan.  Closely related to
CVE-2026-45186, fixed in 2.8.1.  CVSS 3.1
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5).

CVE-2026-76957 -- custom encoding callbacks are now protected against
parser re-entry.  Closely related to CVE-2026-50219, CVE-2026-56131 and
CVE-2026-56412, all fixed in 2.8.2.

CVE-2026-76956 -- inverted getentropy() return handling.  getentropy()
returns 0 on success, but the result was assigned to a bool directly,
inverting the test.  This allowed hash flooding denial of service where
getentropy is the only high quality entropy extractor.  CVSS 3.1
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9).

AI-Assisted-by: Claude Opus 5
Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/src/settings/notifications