-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sun, 11 Oct 2026 15:25:11 +0200
Source: expat
Architecture: source
Version: 2.9.0-1~deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1148665 1149507
Changes:
 expat (2.9.0-1~deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Rebuild for trixie-security
 .
 expat (2.9.0-1) unstable; urgency=high
 .
   * New upstream release:
     - fixes CVE-2026-77214: validate parameter len against available buffer
       capacity in XML_ParseBuffer(),
     - fixes CVE-2026-102633: integer overflow in function expat_realloc()
       on 32bit platforms.
   * Update libexpat1 symbols.
 .
 expat (2.8.5-2) unstable; urgency=high
 .
   * Backport upstream fixes for CVE-2026-102633: replace assert with runtime
     overflow check in expat_realloc (closes: #1149507).
 .
 expat (2.8.5-1) unstable; urgency=medium
 .
   * New upstream release.
 .
 expat (2.8.4-2) unstable; urgency=high
 .
   * Backport upstream fixes for CVE-2026-93990: fails to validate low
     surrogates following high surrogates in UTF-16 input (closes: #1148665).
 .
 expat (2.8.4-1) unstable; urgency=high
 .
   * New upstream release:
     - fixes CVE-2026-66046 and CVE-2026-76641: fix quadratic runtime from
       "attribute isCdata lookups" that allowed denial of service attacks,
     - fixes CVE-2026-76957: protect custom encoding callbacks from parser
       re-entry,
     - fixes CVE-2026-76956: fix inverted getentropy() return handling.
Checksums-Sha1:
 941b0a4b27d13c82ba355981912b42236503bfd0 2157 expat_2.9.0-1~deb13u1.dsc
 757c277106dfab05e1ad895d31ed63c82b438c04 8488503 expat_2.9.0.orig.tar.gz
 b7fc0d435cc0ca3f0ab63ccd687848e4f6ebcf77 14348 expat_2.9.0-1~deb13u1.debian.tar.xz
 1e540318bfeb63b90ed5c2ef5591167e66527f88 5269 expat_2.9.0-1~deb13u1_source.buildinfo
Checksums-Sha256:
 09fe168e2186a2672e077d9fda02287b51fa08f73914fcc425b3307b503df8ff 2157 expat_2.9.0-1~deb13u1.dsc
 6e8ce7b52ebbaa423c59becc7cf1e6875c42e49228c062ac8123c10e700cec27 8488503 expat_2.9.0.orig.tar.gz
 0c1575a3dc3d039f9e6751821efcdfd5246e04c6af4939defa01226d94541fba 14348 expat_2.9.0-1~deb13u1.debian.tar.xz
 557af304e95c3ed8a494c4d843397ca4b6afcdfd3e0bb55b322404a4f71f7c02 5269 expat_2.9.0-1~deb13u1_source.buildinfo
Files:
 8b93d6a8e28ab8fa25b0df2de5e6f792 2157 text optional expat_2.9.0-1~deb13u1.dsc
 a33aef07840ad21397f99299e43b033a 8488503 text optional expat_2.9.0.orig.tar.gz
 2f0a17ecfd0a8acbc5a4fd47052b81b3 14348 text optional expat_2.9.0-1~deb13u1.debian.tar.xz
 c2e7798c92da7f5cee94f0e19d52ee90 5269 text optional expat_2.9.0-1~deb13u1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrNTBVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EL1cP/3xzGnnYB6bX2TqTrD4p5nK8QGBr5Xhf
Qdoat7+GnLLYWNKVmfh+EV6kBqd3RpTwbEHYqnh0RW34rvGEGQMZe2douJmD5lG7
NyRa0QNFzU65p0KGLPNWFR9eRBS2mIR5wAAvcroP2lgmBfyo3cd8QzsrEXUUjF3+
2cD2/98qroE4g6CWWD27V/9Y8zOP4t8k7/2QM5er21h5eDiBg/+YKy23gvMfM7xM
0uFbiDfRzhTZsrofjh/02u+ELi4KZVNtFXLKf4D+vqP52D5NNDV5jDXRfT41B3jK
jltuHuYLEXROW/OpZEsbYE9KTAAzi7gdymdj+3KViJbYd7pMimyN84o3nXuy2Fte
JsqEcsDnqWb60EdcE0muUtcqmRtwv1j0gcfvrKfv5/nT73PVrdlcVfEWJxznZXJ1
oLz95AT0NIK/+wBj01IgAGKeI/3dPOnZ00Kt3yz8VWNRfCntJEMf1ONpHBKrgMlu
VoXz41jr88nhEopQPffebdVuSt06/witz/SxFgvatkSG1Oxg+1aEGe2EGdq9t5vz
lHp7yhqNMbwypMr7nhhm/iH6eEjojlzkigbgNED2Lk6GKYk6mY40tC4/4xgFksHm
CwwpGDe8chgSGf7NcfMljv7Nzl4Nk3Cdx1H4eiol3KcTZP+hjE7pcdFHfXuRmiIU
gaPrz5fj/FK/
=HA4W
-----END PGP SIGNATURE-----