git: a5cc652b1d75 - main - security/vuxml: document expat vulnerabilities
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 13 Feb 2026 09:31:00 UTC
The branch main has been updated by fernape:
URL: https://cgit.FreeBSD.org/ports/commit/?id=a5cc652b1d75e3078108b4aa78a28d6126dc8d21
commit a5cc652b1d75e3078108b4aa78a28d6126dc8d21
Author: Tomáš Čiernik <tomas@ciernik.sk>
AuthorDate: 2026-02-13 09:29:16 +0000
Commit: Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2026-02-13 09:30:39 +0000
security/vuxml: document expat vulnerabilities
* CVE-2026-24515
* CVE-2026-25210
PR: 293078
---
security/vuxml/vuln/2026.xml | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml
index 0c1ce94f5902..5c22ac59672d 100644
--- a/security/vuxml/vuln/2026.xml
+++ b/security/vuxml/vuln/2026.xml
@@ -1,3 +1,33 @@
+ <vuln vid="027c6c07-065b-11f1-baae-589cfc023192">
+ <topic>expat -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>expat</name>
+ <range><lt>2.7.4</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>expat team reports:</p>
+ <blockquote cite="https://github.com/libexpat/libexpat/blob/R_2_7_4/expat/Changes">
+ <p>Update contains 2 security fixes:</p>
+ <ul>
+ <li>CVE-2026-24515: NULL dereference in function XML_ExternalEntityParserCreate</li>
+ <li>CVE-2026-25210: missing check for integer overflow in function doContent</li>
+ </ul>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2026-24515</cvename>
+ <cvename>CVE-2026-25210</cvename>
+ </references>
+ <dates>
+ <discovery>2026-01-31</discovery>
+ <entry>2026-02-10</entry>
+ </dates>
+ </vuln>
+
<vuln vid="e3afc190-0821-11f1-a857-6cc21735f730">
<topic>PostgreSQL -- Multiple vulnerabilities</topic>
<affects>