From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Tue, 03 Nov 2026 20:35:00 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xOKHb-006uUD-1z for lore@lore.pengutronix.de; Tue, 03 Nov 2026 20:35:00 +0100 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xOKHb-0000Pq-55; Tue, 03 Nov 2026 20:34:59 +0100 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xOKHT-0000Pj-2l for ptxdist@pengutronix.de; Tue, 03 Nov 2026 20:34:51 +0100 Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazlp170130006.outbound.protection.outlook.com [IPv6:2a01:111:f403:c201::6]) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPS id CC35E2010E2 for ; Tue, 03 Nov 2026 20:34:46 +0100 (CET) ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1793734486; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding:dkim-signature; bh=8HRO3EUfAYt9+i5nZoA3qJa6jrXqLtyBfDMeqyYh6ig=; b=gkAyDYiTt06dEBcuoF9zzj46TAn7bdvqxEgbp1+oK6daDyOZqw2xas9a07TDXmv2PAJG0q 9zR11U7oNE5gMwtVazvFKHm0QOj7vi52DpQPSnhin7Ques3mXJHJCCk85pcypR9dYiOTHj D5UjqSQtEy0taIrlQ/IoXRaJIWE4kDt33IoZTDfqcyO0uQXI4lP0CUpcN6ekx2OsrRJzNm G55xvlmF7AAfvuWOc3ZIQsrKT3PAy+vDlPIkMMfixShdkqFfvwMc5aL7OqcZX3ojUShppF Oij7J9+d35ZZNvTflTwdj1mjNsA0dYNgaewSOrCwSanacfVIaTV4/14zqtgz6g== ARC-Authentication-Results: i=2; mx1.white.stw.pengutronix.de; dkim=pass header.d=t2datacom.onmicrosoft.com header.s=selector1-t2datacom-onmicrosoft-com header.b=UiSs+MS7; spf=pass (mx1.white.stw.pengutronix.de: domain of christian.melki@t2data.com designates 2a01:111:f403:c201::6 as permitted sender) smtp.mailfrom=christian.melki@t2data.com; dmarc=pass (policy=none) header.from=t2data.com; arc=pass ("microsoft.com:s=arcselector10001:i=1") ARC-Seal: i=2; s=20260414; d=pengutronix.de; t=1793734486; a=rsa-sha256; cv=pass; b=bte2xCpsjSmtwkFb/8e2UjcpuKG4itdVk9OxHVDYN8YH5D7QLQqiFMqoGlzVrkqVmqdCVX UDfwTMToqZI1S0gTVOSJfFXxeTNH+r+5cJsV+mQKhtXGPZoTKFeV7iG/sbqBsAnLm48JX5 9iqCAJhuvCo+MfTBPyWPJYD+SJbCzbHIRF5R7sXls8aSDAJA78SBve+IDiFKRBH5/xZ20+ +gurQhMvyuyOO5MoKmwF+QyT44tArTicv6+du1eO0ToJLk4U2e+LVCeDvDsnL0IU98An9R nxNvlnMMUX9nG8I84hkyAUbdMm/WMaS0/ixgYbeUhg1325Gi6YWb0C/tWOTtbA== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=zR7cViBVgqh2MXMBOnvmj1aMWt/UgAqHMgUlGtAryWqajLuVQ1Boso920gLuqpVOk98+h5vGuEu82s0p+ssKatcBjlD+HEtb/6iezuH6H0M08pvUByq0NoLCdMz7fEHeyOLG6BDOWflpw9xYzAd0Ay5u13hWVbVba/NLty7C5r6LDvHd4s24xEkLbvkKspaYXabRxlEVKy18F8umnMxySPdcx6z98/EsAblY+9ip98pjdkKIULZ3uPBkgcqGH5JrR3mDP+swjB/Rq4d5uGNWt2bhOwxbbIc8MCMsVNbso06Fq13qmu/D5C46Y0gX3P6NPQo4bpkRBT49ZF0enOZySg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=8HRO3EUfAYt9+i5nZoA3qJa6jrXqLtyBfDMeqyYh6ig=; b=mYu1iLMXdSl1MkX53qXOAWWKtyB8Q0VgaaTr5mvuvH/YalYuZSbEv2e4DtwQpRRbPhlCvfCK3opCU2VWx+MbvsBwvgwH6ufd8YPaU/IYIKnWXuWf74J5gGnut5D6T+wTI48/zXnKy/PHVfEfqZ8q58vd4dt72Q0YhPRZaPF1yHawflBCZUe3dGndopt1YqRihl3+1iMDGpB2cW/a2uH5OaVZNZkGo1sShwcvndR6hdJncWJuo84JdZLhipxAr/7PcooKbIcfDnlhZHM6AlP38tFATxpB6x12PicxWv2pWwakCH72xX+ElwWj8PBH0xKk9BzcbbCoifGSizx801jbLQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=t2data.com; dmarc=pass action=none header.from=t2data.com; dkim=pass header.d=t2data.com; arc=none Received: from PAXP251MB0394.EURP251.PROD.OUTLOOK.COM (2603:10a6:102:1dc::12) by BESP251MB060419.EURP251.PROD.OUTLOOK.COM (2603:10a6:b10:143::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.592.8; Tue, 3 Nov 2026 19:34:44 +0000 Received: from PAXP251MB0394.EURP251.PROD.OUTLOOK.COM ([fe80::c8e9:257a:7136:fdc2]) by PAXP251MB0394.EURP251.PROD.OUTLOOK.COM ([fe80::c8e9:257a:7136:fdc2%3]) with mapi id 15.21.0592.009; Tue, 3 Nov 2026 19:34:44 +0000 From: Christian Melki To: ptxdist@pengutronix.de Date: Tue, 3 Nov 2026 20:34:37 +0100 Message-ID: <20261103193437.1730901-1-christian.melki@t2data.com> X-Mailer: git-send-email 2.43.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: GVX0EPF0005F69C.SWEP280.PROD.OUTLOOK.COM (2603:10a6:158:400::135) To PAXP251MB0394.EURP251.PROD.OUTLOOK.COM (2603:10a6:102:1dc::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PAXP251MB0394:EE_|BESP251MB060419:EE_ X-MS-Office365-Filtering-Correlation-Id: 9a630f5c-74c1-4c9a-7334-08df39e18323 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|23010399003|376014|52116014|1800799024|366016|10067099003|18002099003|56012099006|261021121427099003|261102123227099003|261009223027099003|260925021311599003|38350700014|261021123027099003|260925022911599003|260925021911599003; X-Microsoft-Antispam-Message-Info: 6TIasq6wF1doWhKmNmc4sKkTDJBfEomstdkvIRDhcgAxXdldzMjwgNnLL9wjUPssBhEXvm6v7qzjM2dRS/4nL64VEZQQ9K4HReXOtoIgi4+TUhl+FxzRwKA9iV9vmOK5XSYPg2Eu1tOC8E92vFcO7DioSPaAPeiVnwHFYtW8WtlECaIJpZ0depEbIhK9IOArpDq/+FoOtmTgUHLjN+RzNiktKVQWYRBDDpreRhVf6km7zdTpQPCLKMNN4nxmFyCvZ5rA1Q4m/+CEfauUyMWOM/VBKwKIxNaVw7M3J7aJqdsudGRTEH+ttSMhIo81iW8DOfv2CArpFa/kX5M61YJ+mGwRGCpBRprIbfpbB9G9EzJh+5p85ruSucS+T3owcQfyCjo1BJ7jsBfVOmSWW0oyegg0CPogq4K80Y3+R5iNhGw199VUH5+FMGa5wjeUNMRcZ5Yy/fjz/g0bWWSQANgamiTkEFRZ6eNZ3B+RZFOFVv1I9K4CUmeqRsgY/EHmBe5UwG0oNqwgk8MDCuy8bgASfibdDKF8Gv0rkky4Z22palBe3DP61PcVKjvDx5FVYElJGZVp0pY3zHK5OmUSep0KOllBRK0iRimFoOcvpyiFJkJhdwmKNDl4GCmHv0hEiAoquL/bEs09DEF48a5TaFOU5bwYAVR/+JJckiS3p53m9zM1Iq5hI2Ffdjgl4gGO8lrkrVM3FzEqwzZqgzz4Rw/lFw4BOYjx47BXF+bnh/d7Em4= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:PAXP251MB0394.EURP251.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230040)(23010399003)(376014)(52116014)(1800799024)(366016)(10067099003)(18002099003)(56012099006)(261021121427099003)(261102123227099003)(261009223027099003)(260925021311599003)(38350700014)(261021123027099003)(260925022911599003)(260925021911599003); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Szt/fVRWvlIzAkW0ngouV+Qulg7pQIak66bpkd+44KxJr01dDWVSqa9En7Ie?= =?us-ascii?Q?8+lop+SoBEUIShfLR3CTIqgQ00LqBQ1a4HwbuXSXijzbta2t85oIrKYCuDxz?= =?us-ascii?Q?vbM3JEMsLhdpMpERabHyEnEkdUgrsM3R4jihRg0pIGSjskLURSwGJjbx06NI?= =?us-ascii?Q?b5kUnwTBGqzYKXg7vuxZcUd20XsgB/4mBr9UC9Qlbc608pIquMKDMRBTA9zg?= =?us-ascii?Q?CsimM9yAr89mXhsO/yQuWTiDo4/fwy0mPdsJkMhBECzTtEfZMJXIJdpp7yHv?= =?us-ascii?Q?1ldzbii/Km1c3wJap8lybScCBn/iTGMlw2OJguBwt/IqFzCxX3QGtAVp2VTw?= =?us-ascii?Q?0E8pk0MCc2Sgv5RfSIB+MOYYfhjIr4lzIoMJnhZXImqAoaRiAFi8AVV1t7nC?= =?us-ascii?Q?4s7GW2SQLHLyWEcNfbj6HfKkpHllC/dRcWiEMxtZYeTooC3+0KKdNYTib56f?= =?us-ascii?Q?sHnEFoLgjxjFRfKCFd43obwRVCTKPw8JneTc/iXgeGT6Ixl4/2+3oBLTAAMg?= =?us-ascii?Q?E0LnNgwPzBfj2iaw3jqtro8bLkez+MGfgMXlgY9M4FJO2KlJQgfiJTnJN2VT?= =?us-ascii?Q?Jg0oNh/B1YB2E0kyhCNobhc5ZczCHXcMMqaMMKbqd7B1M9pMnr2q9DJL1LcR?= =?us-ascii?Q?0ubRIssCApji/f63BAbESokxXPvuAixBV/SLZ3ivRtEFi+zihlHBSNIIAcsW?= =?us-ascii?Q?Z92xF1EfAU5foK2XfiSigScRtwTWHtRkcvUyvLnVOFcemC4qkcF/XxaCKeFh?= =?us-ascii?Q?T2cexJvzstRZh22z5a9kDahQB0bKdGc0YyjfLKghGtXcglHXnpnETDGKMyg4?= =?us-ascii?Q?KBVO+4q/rq4pLrRL6eua+cTywpqk1Bu1Wq293rG7FFyVxWSWHqISbFGq1ccU?= =?us-ascii?Q?4HZ4A2NndaIMe2x0lqb0ZnqL/prNCKMf4JqXybhtMtiw2lhxl2REe+KjN8Br?= =?us-ascii?Q?w7E54S7q7GXyvVxF5q72wCn+yZ9V2TsQ3P1Tj73R+oA1nvqhnKGJumbPWNVL?= =?us-ascii?Q?UzsJ6jaoh73UxbAkZmLz9iREgWxzndlb1TW4Zj3g6V2T0PaGCAPDzgAzdgww?= =?us-ascii?Q?pvzClVtmlaV8h1nZoJfgBXeQUcPYOIO0gO2sl6V0Zv1xMAM4RmTX0Iip/NeR?= =?us-ascii?Q?c3CM5u08NugFfPAmubzqxmzP80TMG2pLRYdCq3z+xlX42/tz0fDt7QW7ihiY?= =?us-ascii?Q?PuzuH+N3kcjbsAGf/dcYST+wplVuCObzhns4LnmVGNFqqBs9n6eIPZOggyip?= =?us-ascii?Q?ZArERw8F8kPkqsjKw/oXa8rMwzrdSg1uIx5AuUKSQXwDrNTWfNE/dLSVrhGP?= =?us-ascii?Q?LE/vw+Fd4Qi7+5DFcmHinc34bLUXHgzHBUcxQOWLrSiNHcAVszl8M91iIni+?= =?us-ascii?Q?scrZ4f0KxxjkGQkV+wnCO2lHt5oOGPquFu/rcq5KcYlo1KtDVgPJy7AgGCqo?= =?us-ascii?Q?CbdpJMTP3Gx/KPCa1XO8PdsNUf6JEwSbZakhDhMwFHHA9TevecljvL9EgQ3P?= =?us-ascii?Q?lJKNbh0Y8EqtFFmo3Lr/DEgFKTS9Z89AEuPo2mzWnAU03SgLgUEqnNeluaC4?= =?us-ascii?Q?OMrmVAOv8k9OV4k30HHp0oKS3Lysi73MYbuUmSq69go6Q1NWkhiw3BB/p6Iw?= =?us-ascii?Q?ohpokCaBXcyX94xovdZuMDg9ap+5uCLtQf6cPHoWw9LqS3Ma6KVWjJjaaafi?= =?us-ascii?Q?JqkgVQHk2FKXHB3ic/lwZZwJHVJTz3GD7T7QeYpN99jjQTjwWRmkgKnx37IW?= =?us-ascii?Q?H6UowNPzRgJUO9dWe1V4p2v6mAOejz4=3D?= X-OriginatorOrg: t2data.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9a630f5c-74c1-4c9a-7334-08df39e18323 X-MS-Exchange-CrossTenant-AuthSource: PAXP251MB0394.EURP251.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Nov 2026 19:34:44.5573 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 27928da5-aacd-4ba1-9566-c748a6863e6c X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 0ePsgw5+UwOXPCWP3+/0JxAHsCBb8WjucPh7EeD6Jy3pk1tKmVK81Pi6+dREf6wRMD9hgXxC5r1GuuFODKC1Qtc1OSckuXBJEraoATEyGkc= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BESP251MB060419 X-Rspamd-Server: mx1 X-Rspamd-Queue-Id: CC35E2010E2 X-Spamd-Result: default: False [-3.50 / 15.00]; BAYES_HAM(-3.00)[99.99%]; MID_CONTAINS_FROM(1.00)[]; ARC_ALLOW(-1.00)[microsoft.com:s=arcselector10001:i=1]; R_MISSING_CHARSET(0.50)[]; DMARC_POLICY_ALLOW(-0.50)[t2data.com,none]; R_DKIM_ALLOW(-0.20)[t2datacom.onmicrosoft.com:s=selector1-t2datacom-onmicrosoft-com]; R_SPF_ALLOW(-0.20)[+ip6:2a01:111:f403:c000::/51]; MIME_GOOD(-0.10)[text/plain]; RCVD_TLS_LAST(0.00)[]; NEURAL_HAM(-0.00)[-0.873]; RCPT_COUNT_ONE(0.00)[1]; ARC_SIGNED(0.00)[pengutronix.de:s=20260414:i=2]; MIME_TRACE(0.00)[0:+]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[2a01:111:f403:c201::6:from]; TO_DN_NONE(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; ASN(0.00)[asn:8075, ipnet:2a01:111:f000::/36, country:US]; DKIM_TRACE(0.00)[t2datacom.onmicrosoft.com:+]; FROM_HAS_DN(0.00)[] X-Rspamd-Action: no action X-Stat-Signature: dibs3squni9nk3ft5zak99x7cc58cyi4 Subject: [ptxdist] [PATCH] expat: Version bump. 2.9.0 -> 2.10.0 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Security and some minor fixes. Plugs CVEs: CVE-2026-113351: Fix denial of service with use of XML_ParserReset. CVE-2026-115506: Detect billion laughs attacks quicker and more of its variations. CVE-2026-117610: Fix initial non-final empty subparser parse calls. CVE-2026-118370: Protect attIndex and nPrefixes from signed integer overflow. Signed-off-by: Christian Melki --- rules/expat.make | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/expat.make b/rules/expat.make index 9695fc896..fb40056bf 100644 --- a/rules/expat.make +++ b/rules/expat.make @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_EXPAT) += expat # # Paths and names # -EXPAT_VERSION := 2.9.0 -EXPAT_SHA256 := 775e8a68f81a748a401dc3168318d4a39484eb4f954726f21517c8f42c0ba984 +EXPAT_VERSION := 2.10.0 +EXPAT_SHA256 := 44e0139015f1c9908d0876b5516235136f16b14932d8f6634a16737a12742f53 EXPAT := expat-$(EXPAT_VERSION) EXPAT_SUFFIX := tar.bz2 EXPAT_RELEASE := R_$(subst .,_,$(EXPAT_VERSION)) -- 2.43.0