Re: [LFS Trac] #5933: expat-2.8.1 (Security update)

#5933: expat-2.8.1 (Security update)
-------------------------+-----------------------
 Reporter:  Bruce Dubbs  |       Owner:  lfs-book
     Type:  enhancement  |      Status:  new
 Priority:  high         |   Milestone:  13.1
Component:  Book         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-----------------------
Comment (by Bruce Dubbs):

 {{{
 Release 2.8.1 Sun May 10 2026
         Security fixes:
            #1216  CVE-2026-45186 -- Fix quadratic runtime from attribute
 name
                     collision checks that allowed denial of service
 attacks
                     through moderately sized crafted XML input (CWE-407).
                     Please note that a layer of compression around XML can
                     significantly reduce the minimum attack payload size.

         Other changes:
      #1209 #1213  Drop more casts related to `void *` that C99 does not
 need
            #1213  xmlwf: Streamline use of `mmap`
      #1214 #1217  Version info bumped from 13:0:12 (libexpat*.so.1.12.0)
                     to 13:1:12 (libexpat*.so.1.12.1); see
 https://verbump.de/
                     for what these numbers do

         Infrastructure:
            #1210  CI: Cover compilation with Visual Studio 18 2026 on
 Windows
            #1215  CI: Cover compilation for ARM64 on Windows
            #1212  CI: Bump WASI SDK from 32 to 33
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/5933#comment:1>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page