Release date:
2026-09-24 12:16:45 UTC
Description:
- CVE-2026-93990: reject a UTF-16 high surrogate that is not followed by a low
surrogate, by adding LITTLE2_/BIG2_IS_INVALID_CHAR and the matching
little2_/big2_isInvalid4 vtable entries to the UTF-16 tokenizers in
lib/xmltok.c, so a lone high surrogate can no longer consume the following
code unit as a fake low surrogate and hide markup from the parser
Updated packages:
-
expat-2.5.0-1.el8.tuxcare.els9.i686.rpm
sha:d2bdf78a004afce72c90fd1108929fd0d08fdf1210456c82ae919427f3f22b53
-
expat-2.5.0-1.el8.tuxcare.els9.x86_64.rpm
sha:fb2e1ce45099e01445c15db4fb44a2faa1cfa1fe2cc7dc1364d17f709a64fbec
-
expat-devel-2.5.0-1.el8.tuxcare.els9.i686.rpm
sha:25c05a74cdbebf0286987559dcac98af3d7328a763d8ab260624ee2518ccc6a3
-
expat-devel-2.5.0-1.el8.tuxcare.els9.x86_64.rpm
sha:6373e89c79058b87c30f4ab683ebb47d125219fab6cd04f19aa102fc99e33bb1
-
expat-static-2.5.0-1.el8.tuxcare.els9.i686.rpm
sha:392499e4ceac6492cfa561d854c7056d1d9093498b57a1652a4970b05ff43720
-
expat-static-2.5.0-1.el8.tuxcare.els9.x86_64.rpm
sha:e7fd00dde48924ec47020ced5bd08a0f0dd1c3e0216f2e86e40cfebb4bd87793
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
