[CLSA-2026:1794315884] expat: Fix of 2 CVEs
Type:
security
Severity:
Important
Release date:
2026-11-10 13:04:56 UTC
Description:
- CVE-2026-117610: NULL pointer dereference in externalEntityInitProcessor2 on initial empty non-final subparser input - CVE-2026-118370: signed integer overflow of attIndex/nPrefixes in storeAtts
CVEs fixed:
Updated packages:
  • expat-2.1.0-15.0.7.amzn2.tuxcare.els12.aarch64.rpm
    sha:c4f491034a4ee8f444d277cc891947c6f0b88cb182acabdbab3d4571b39e0ffe
  • expat-2.1.0-15.0.7.amzn2.tuxcare.els12.i686.rpm
    sha:754f28b4b41441781140b2b147306dd8f071ab9f3fe58a58aa8f68d90e3e0578
  • expat-2.1.0-15.0.7.amzn2.tuxcare.els12.x86_64.rpm
    sha:f029e8d247856025603d22eb2258e5268da6a28916e44aee9dc5964cdbdb1918
  • expat-devel-2.1.0-15.0.7.amzn2.tuxcare.els12.aarch64.rpm
    sha:7b81cfc183c061176b30d3c153189be84b15e946409d1b3b72a827723a32efe3
  • expat-devel-2.1.0-15.0.7.amzn2.tuxcare.els12.i686.rpm
    sha:c2d30220f94f7e1aab4f5c148beb25f1ff80e5ac2dd6030702a27a626501ec4e
  • expat-devel-2.1.0-15.0.7.amzn2.tuxcare.els12.x86_64.rpm
    sha:43e59d1ae8f1b6f7cd989de965ece95e0e353b4b15960b95b7831ffdd8a25c34
  • expat-static-2.1.0-15.0.7.amzn2.tuxcare.els12.aarch64.rpm
    sha:1684438ef057920044943f23dd25f97fb84e542526e497335a02f25e33a9c8cc
  • expat-static-2.1.0-15.0.7.amzn2.tuxcare.els12.i686.rpm
    sha:8825ac149048be9f195158a2f010bd123ee6b0737eeb1855d2d0ac6a9c7f8786
  • expat-static-2.1.0-15.0.7.amzn2.tuxcare.els12.x86_64.rpm
    sha:a5d626cd316c1686162cc501b798f5d93eeddaadbb52bb93b3da713bde932d5c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.