Expat 2.10.0 released, fixes four vulnerabilities
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Expat 2.10.0, the C XML parser library, fixes four security issues, according to maintainer Sebastian Pipping. Two are explained in detail: variants of billion and parameter laughs attacks that Hanno Böck's fuzzer found, now caught faster by pre-computing entity expansion, and an XML_ParserReset bug that could make later documents fail. The known unfixed count rose from 5 in August to 13, as 20 new findings outpaced 12 fixes. The CVE details come from the maintainer alone. Anyone bundling or pinning Expat should update.