Release date:
2026-10-04 19:51:19 UTC
Description:
- CVE-2026-66046: replace the linear scan of elementType->defaultAtts in
storeAtts() with a hash table lookup, and carry the attribute index
over in dtdCopy() so the lookup stays in bounds
- CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by
a low surrogate, so a lone high surrogate can no longer consume the
next code unit as a fake low and hide markup such as '<' from the
tokenizer
Updated packages:
-
expat-2.5.0-1.el9_2.tuxcare.els17.aarch64.rpm
sha:082bb1f53325592c632b1d6292d7ee035ce6dcb635b1fb0d8457fc92aa87a498
-
expat-2.5.0-1.el9_2.tuxcare.els17.i686.rpm
sha:90ee9fe57d3595f09637a1c48c15c34517d35861b3fc998037e8d21c1e632a05
-
expat-2.5.0-1.el9_2.tuxcare.els17.x86_64.rpm
sha:fea9b81e2996d9f7c1ee52918df7b6ed7805fb327e51a3173a8f205528769f3a
-
expat-devel-2.5.0-1.el9_2.tuxcare.els17.aarch64.rpm
sha:4a9597f18f934bdcadbaeee596dc3cd7f88f99a74ffdd65411876da255be8e87
-
expat-devel-2.5.0-1.el9_2.tuxcare.els17.i686.rpm
sha:0418241b90ed0a0fb56e97f597ffab6c20694e9c5c6bc1a2924f586682297088
-
expat-devel-2.5.0-1.el9_2.tuxcare.els17.x86_64.rpm
sha:f000fbfc1e748eff624d29bde3f7521080df33614c81c66ccee0608c58133fbb
-
expat-static-2.5.0-1.el9_2.tuxcare.els17.aarch64.rpm
sha:a4afce39c86441ded0a6e81319b5f6ed20447bea522d9077493622aece8c26d9
-
expat-static-2.5.0-1.el9_2.tuxcare.els17.i686.rpm
sha:a91efb1848dd9f97dc4548740d6910769ca7a7b4b3137be052928289008c7902
-
expat-static-2.5.0-1.el9_2.tuxcare.els17.x86_64.rpm
sha:fb3844a80c1290af9225c6a9b1e67914a230bc6025cab191cd11f87637622b61
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
