Release date:
2026-09-24 12:22:59 UTC
Description:
- CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low
surrogate, by adding LITTLE2_/BIG2_IS_INVALID_CHAR and the matching
little2_/big2_isInvalid4 vtable entries to the UTF-16 tokenizers in
lib/xmltok.c, so a lone high surrogate can no longer consume the following
code unit as a fake low surrogate and hide markup from the parser
Updated packages:
-
expat-2.5.0-1.el8.tuxcare.els9.i686.rpm
sha:51ee8a4911233a557258fd96e7e06c617b518f61856e5b1ae79c371b9a882b4a
-
expat-2.5.0-1.el8.tuxcare.els9.x86_64.rpm
sha:da9b6d5efada5f83e6f838de8cf03142bc39364582990b9542b8ff888151bb00
-
expat-devel-2.5.0-1.el8.tuxcare.els9.i686.rpm
sha:be28fc2d15e56a076bbcea99a49cead777ebfebd91b7bb7071b2f066850a0735
-
expat-devel-2.5.0-1.el8.tuxcare.els9.x86_64.rpm
sha:81cff67f3b5ab290cb5a52c00659f67595a27e0a07c25cb09eb42cdb9ca1bd7c
-
expat-static-2.5.0-1.el8.tuxcare.els9.i686.rpm
sha:e0a8674ad15a34691c8d5a8c103ee3d547ea7975eb97aba25643b642cc5f70c5
-
expat-static-2.5.0-1.el8.tuxcare.els9.x86_64.rpm
sha:ec0765e793f7f588d17c728a4a289e9a5af06ea37fd1178b766b45fd0b031e03
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
