[Git][security-tracker-team/security-tracker][master] Add more expat issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b6b67e52 by Salvatore Bonaccorso at 2026-06-21T21:21:37+02:00
Add more expat issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -16,17 +16,29 @@ CVE-2026-56409 (xmlwf in libexpat before 2.8.2 has an integer overflow for the o
 	NOTE: https://github.com/libexpat/libexpat/pull/1259
 	NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e
 CVE-2026-56408 (libexpat before 2.8.2 has an integer overflow in copyString.)
-	TODO: check
+	- expat <unfixed>
+	NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817
 CVE-2026-56407 (libexpat before 2.8.2 has an integer overflow in doProlog that is rela ...)
-	TODO: check
+	- expat <unfixed>
+	NOTE: https://github.com/libexpat/libexpat/pull/1262
+	NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13
 CVE-2026-56406 (libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer becau ...)
-	TODO: check
+	- expat <unfixed>
+	NOTE: https://github.com/libexpat/libexpat/pull/1255
+	NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/99d8454fdf900a6d00c2a52748e6c0eeb507574d
 CVE-2026-56405 (libexpat before 2.8.2 has an integer overflow in getAttributeId.)
-	TODO: check
+	- expat <unfixed>
+	NOTE: https://github.com/libexpat/libexpat/pull/1251
+	NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/2c6c42d33689f6b266a5267b639e03cde17e53c0
 CVE-2026-56404 (libexpat before 2.8.2 has an integer overflow in addBinding.)
-	TODO: check
+	- expat <unfixed>
+	NOTE: https://github.com/libexpat/libexpat/pull/1249
+	NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/babfc48090977cbf7be24b2c48f6053dca75c164
 CVE-2026-56403 (libexpat before 2.8.2 has an integer overflow in storeAtts.)
-	TODO: check
+	- expat <unfixed>
+	NOTE: https://github.com/libexpat/libexpat/pull/1232
+	NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648
+	NOTE: Fixed by: https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15
 CVE-2026-56397 (SiYuan before v3.6.1 fails to sanitize package metadata and README con ...)
 	TODO: check
 CVE-2026-56396 (phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities i ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6b67e52d492b888dffea05615a3b8ab9b17abb7

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6b67e52d492b888dffea05615a3b8ab9b17abb7
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260621/3a9f9541/attachment.htm>