• From: Sebastian Pipping <sebastian@p...>
• To: xml-dev@l...
• Date: Wed, 21 Sep 2022 17:52:16 +0200

Hello everyone!


(A *longer* blog-post version of this e-mail is available online at
 https://blog.hartwork.org/posts/expat-2-4-9-released/ .)

Expat 2.4.9 [1] has been released yesterday. Alongside the usual
pile of improvements to the build system, most importantly this release
fixes CVE-2022-40674: a heap use-after-free vulnerability in function
doContent with expected impact of denial of service or potentially
arbitrary code execution. For more details, please check out the change
log [2].

If you maintain Expat packaging or a bundled copy of Expat or a pinned
version of Expat somewhere, please update to 2.4.9.  Thank you!

Best



Sebastian Pipping


[1] https://github.com/libexpat/libexpat/releases/tag/R_2_4_9
[2] https://github.com/libexpat/libexpat/blob/R_2_4_9/expat/Changes