CLSA-2026-1786451206
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786451206.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1786451206
- Upstream
- Published
- 2026-08-11T12:26:59Z
- Modified
- 2026-10-26T09:31:52Z
- Summary
- Fix CVE(s): CVE-2026-56407, CVE-2026-56408, CVE-2026-56409
- Details
-
- SECURITY UPDATE: Integer overflow in doProlog related to
storeEntityValue and entity textLen (libexpat before 2.8.2)
- debian/patches/CVE-2026-56407.patch: cap the entity value pool length at INT_MAX before assigning it to the signed ENTITY::textLen in doProlog
- CVE-2026-56407
- SECURITY UPDATE: Integer overflow in copyString (libexpat before
2.8.2)
- debian/patches/CVE-2026-56408.patch: reject lengths above SIZE_MAX / sizeof(XML_Char) before sizing the copy, closing the multiplication overflow in wide-character (libexpatw) builds
- CVE-2026-56408
- SECURITY UPDATE: Integer overflow for the output filename in xmlwf
when -d outputDir is used (libexpat before 2.8.2)
- debian/patches/CVE-2026-56409.patch: check the output path join for addition and multiplication overflow, and check the malloc result, before writing the joined path
- CVE-2026-56409
- SECURITY UPDATE: Integer overflow in doProlog related to
storeEntityValue and entity textLen (libexpat before 2.8.2)
- References
Affected packages
TuxCare:Debian:10 / expat
Package
- Name
- expat
- Purl
- pkg:deb/tuxcare/expat?distro=debian-10
TuxCare:Debian:10 / libexpat1
Package
- Name
- libexpat1
- Purl
- pkg:deb/tuxcare/libexpat1?distro=debian-10