SUSE-SU-2026:24460-1
- Source
- https://www.suse.com/support/update/announcement/2026/suse-su-202624460-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24460-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2026:24460-1
- Upstream
- Related
- Published
- 2026-10-27T16:12:58Z
- Modified
- 2026-11-02T17:23:09Z
- Summary
- Security update for expat
- Details
-
This update for expat fixes the following issues:
- CVE-2026-77214: out-of-bounds read due to insufficient checks in
XML_ParseBuffer()(bsc#1284334). - CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
- CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).
Changes for expat:
Update to 2.8.5 (jsc#PED-16154):
- Bug fixes:
- Fix an OOM-related memory leak on a failed overflow check
- Fix memory alignment for architectures with 128bit pointers
- Mark XML_SetHashSalt deprecated
- CVE-2026-77214: out-of-bounds read due to insufficient checks in
- References
-
- https://www.suse.com/support/update/announcement/2026/suse-su-202624460-1/
- https://bugzilla.suse.com/1275115
- https://bugzilla.suse.com/1282347
- https://bugzilla.suse.com/1283493
- https://bugzilla.suse.com/1284334
- https://www.suse.com/security/cve/CVE-2026-102633
- https://www.suse.com/security/cve/CVE-2026-32776
- https://www.suse.com/security/cve/CVE-2026-32777
- https://www.suse.com/security/cve/CVE-2026-32778
- https://www.suse.com/security/cve/CVE-2026-56403
- https://www.suse.com/security/cve/CVE-2026-56404
- https://www.suse.com/security/cve/CVE-2026-56405
- https://www.suse.com/security/cve/CVE-2026-77214
- https://www.suse.com/security/cve/CVE-2026-93990