Release date:
2026-09-23 14:16:18 UTC
Description:
- CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low
surrogate, by adding LITTLE2_/BIG2_IS_INVALID_CHAR and the matching
little2_/big2_isInvalid4 vtable entries to the UTF-16 tokenizers in
lib/xmltok.c, so a lone high surrogate can no longer consume the following
code unit as a fake low surrogate and hide markup from the parser
Updated packages:
-
expat-2.5.0-1.el8.tuxcare.els9.i686.rpm
sha:99044930b9e94b75f60350d5b285c750f821846e4b8789d86b89bc46f3c20c31
-
expat-2.5.0-1.el8.tuxcare.els9.x86_64.rpm
sha:edd53c91b6466a1ac5899f99a6343eef1ce14504274011c5cd2d1988db17f0e4
-
expat-devel-2.5.0-1.el8.tuxcare.els9.i686.rpm
sha:06dbc88f67e0f6679b431afbd919c439c44743c653bd92711968293d35f13ffd
-
expat-devel-2.5.0-1.el8.tuxcare.els9.x86_64.rpm
sha:5254dae426a327da9a6c6460bc57afa4630abdea0795fbf85484506e45667aff
-
expat-static-2.5.0-1.el8.tuxcare.els9.x86_64.rpm
sha:3f335d5cb6f6041d859ccf6c70df23f40b700e3c47945d7edf7951856959f90a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
