openSUSE-SU-2026:22177-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22177-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22177-1
Upstream
CVE (9)
Related
CVE (9)
Published
2026-10-27T16:07:43Z
Modified
2026-11-01T17:23:29Z
Summary
Security update for expat
Details

This update for expat fixes the following issues:

  • CVE-2026-77214: out-of-bounds read due to insufficient checks in XML_ParseBuffer() (bsc#1284334).
  • CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347).
  • CVE-2026-102633: denial of service via integer overflow in expat_realloc (bsc#1283493).

Changes for expat:

Update to 2.8.5 (jsc#PED-16154):

  • Bug fixes:
  • Fix an OOM-related memory leak on a failed overflow check
  • Fix memory alignment for architectures with 128bit pointers
  • Mark XML_SetHashSalt deprecated
References

Affected packages

openSUSE:Leap 16.0 / expat

Package

Name
expat
Purl
pkg:rpm/opensuse/expat&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.8.5-160000.1.1

Ecosystem specific 

{
    "binaries":  [
        {
            "expat":  "2.8.5-160000.1.1",
            "libexpat-devel":  "2.8.5-160000.1.1",
            "libexpat1":  "2.8.5-160000.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22177-1.json"