[CLSA-2026:1788869942] Fix CVE(s): CVE-2026-72522, CVE-2026-76957

Type:

security

Severity:

Critical

Release date:

2026-09-08 12:19:14 UTC

Description:

   * SECURITY UPDATE:
     - debian/patches/CVE-2026-72522.patch: stop the UTF-16 to UTF-16
       converters mis-classifying a trailing low surrogate as a high
       surrogate, which truncated input and lost a code unit, by masking
       with 0xFC instead of 0xF8 in expat/lib/xmltok.c
     - debian/patches/CVE-2026-76957.patch: protect the application-supplied
       XML_Encoding convert and release callbacks from parser reentry by
       routing them through expat's handler call-depth tracking in
       expat/lib/xmlparse.c, closing a use-after-free
     - CVE-2026-72522
     - CVE-2026-76957

CVEs fixed:

Updated packages:

expat_2.2.9-1ubuntu0.8+tuxcare.els7_amd64.deb
sha:bf8cd0f5b145e4371da1cd09c14c85d4e35d876b
libexpat1_2.2.9-1ubuntu0.8+tuxcare.els7_amd64.deb
sha:50825bf953065f5eb338a83c52edfcffe6443929
libexpat1-dev_2.2.9-1ubuntu0.8+tuxcare.els7_amd64.deb
sha:44533fb1ed1c11685e6793d1ac668d3e40c3c658
expat_2.2.9-1ubuntu0.8+tuxcare.els7_arm64.deb
sha:bab3e1d3a3ca8631c4fe3f28b46223d856b0d3d7
libexpat1_2.2.9-1ubuntu0.8+tuxcare.els7_arm64.deb
sha:ef5b69ff83673e4db1cbf37367b2a27299d5019f
libexpat1-dev_2.2.9-1ubuntu0.8+tuxcare.els7_arm64.deb
sha:4e8e9dd536c3f503bb34dc30c9ae8f0ddc509ec0

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.