Skip to content

Commit be30df0

Browse files
azurelinux-securityazurelinux-security
authored
[AutoPR- Security] Patch expat for CVE-2026-25210 [MEDIUM] (#15651)
1 parent 004e03d commit be30df0

File tree

6 files changed

+112
-15
lines changed

6 files changed

+112
-15
lines changed

‎SPECS/expat/CVE-2026-25210.patch‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
From 5ffd029337a8db6b3bef77ecd0a040b3e1e573f2 Mon Sep 17 00:00:00 2001
2+
From: Matthew Fernandez <matthew.fernandez@gmail.com>
3+
Date: Thu, 2 Oct 2025 17:15:15 -0700
4+
Subject: [PATCH 1/3] lib: Make a doubling more readable
5+
6+
Suggested-by: Sebastian Pipping <sebastian@pipping.org>
7+
---
8+
lib/xmlparse.c | 2 +-
9+
1 file changed, 1 insertion(+), 1 deletion(-)
10+
11+
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
12+
index d804753..a48acd2 100644
13+
--- a/lib/xmlparse.c
14+
+++ b/lib/xmlparse.c
15+
@@ -3492,7 +3492,7 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
16+
tag->name.strLen = convLen;
17+
break;
18+
}
19+
- bufSize = (int)(tag->bufEnd - tag->buf) << 1;
20+
+ bufSize = (int)(tag->bufEnd - tag->buf) * 2;
21+
{
22+
char *temp = (char *)REALLOC(parser, tag->buf, bufSize);
23+
if (temp == NULL)
24+
--
25+
2.45.4
26+
27+
28+
From 07d55b4f18ded4740946a9a436e787b3c178176c Mon Sep 17 00:00:00 2001
29+
From: Matthew Fernandez <matthew.fernandez@gmail.com>
30+
Date: Thu, 2 Oct 2025 17:15:15 -0700
31+
Subject: [PATCH 2/3] lib: Realign a size with the `REALLOC` type signature it
32+
is passed into
33+
34+
Note that this implicitly assumes `tag->bufEnd >= tag->buf`, which should
35+
already be guaranteed true.
36+
---
37+
lib/xmlparse.c | 3 +--
38+
1 file changed, 1 insertion(+), 2 deletions(-)
39+
40+
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
41+
index a48acd2..ed505b7 100644
42+
--- a/lib/xmlparse.c
43+
+++ b/lib/xmlparse.c
44+
@@ -3481,7 +3481,6 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
45+
const char *fromPtr = tag->rawName;
46+
toPtr = (XML_Char *)tag->buf;
47+
for (;;) {
48+
- int bufSize;
49+
int convLen;
50+
const enum XML_Convert_Result convert_res
51+
= XmlConvert(enc, &fromPtr, rawNameEnd, (ICHAR **)&toPtr,
52+
@@ -3492,7 +3491,7 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
53+
tag->name.strLen = convLen;
54+
break;
55+
}
56+
- bufSize = (int)(tag->bufEnd - tag->buf) * 2;
57+
+ const size_t bufSize = (size_t)(tag->bufEnd - tag->buf) * 2;
58+
{
59+
char *temp = (char *)REALLOC(parser, tag->buf, bufSize);
60+
if (temp == NULL)
61+
--
62+
2.45.4
63+
64+
65+
From 3776e1554b8b9506387ec8a0591560898fb1ef87 Mon Sep 17 00:00:00 2001
66+
From: Matthew Fernandez <matthew.fernandez@gmail.com>
67+
Date: Thu, 2 Oct 2025 17:15:15 -0700
68+
Subject: [PATCH 3/3] lib: Introduce an integer overflow check for tag buffer
69+
reallocation
70+
71+
Suggested-by: Sebastian Pipping <sebastian@pipping.org>
72+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
73+
Upstream-reference: https://github.com/libexpat/libexpat/pull/1075.patch
74+
---
75+
lib/xmlparse.c | 2 ++
76+
1 file changed, 2 insertions(+)
77+
78+
diff --git a/lib/xmlparse.c b/lib/xmlparse.c
79+
index ed505b7..0bf913c 100644
80+
--- a/lib/xmlparse.c
81+
+++ b/lib/xmlparse.c
82+
@@ -3491,6 +3491,8 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
83+
tag->name.strLen = convLen;
84+
break;
85+
}
86+
+ if (SIZE_MAX / 2 < (size_t)(tag->bufEnd - tag->buf))
87+
+ return XML_ERROR_NO_MEMORY;
88+
const size_t bufSize = (size_t)(tag->bufEnd - tag->buf) * 2;
89+
{
90+
char *temp = (char *)REALLOC(parser, tag->buf, bufSize);
91+
--
92+
2.45.4
93+

‎SPECS/expat/expat.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: An XML parser library
33
Name: expat
44
Version: 2.6.4
5-
Release: 3%{?dist}
5+
Release: 4%{?dist}
66
License: MIT
77
Vendor: Microsoft Corporation
88
Distribution: Azure Linux
@@ -12,6 +12,7 @@ Source0: https://github.com/libexpat/libexpat/releases/download/R_%{under
1212
Patch0: CVE-2024-8176.patch
1313
Patch1: CVE-2025-59375.patch
1414
Patch2: CVE-2026-24515.patch
15+
Patch3: CVE-2026-25210.patch
1516
Requires: %{name}-libs = %{version}-%{release}
1617

1718
%description
@@ -69,6 +70,9 @@ rm -rf %{buildroot}/%{_docdir}/%{name}
6970
%{_libdir}/libexpat.so.1*
7071

7172
%changelog
73+
* Mon Feb 02 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.6.4-4
74+
- Patch for CVE-2026-25210
75+
7276
* Tue Jan 27 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.6.4-3
7377
- Patch for CVE-2026-24515
7478

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,9 @@ elfutils-libelf-0.189-6.azl3.aarch64.rpm
9999
elfutils-libelf-devel-0.189-6.azl3.aarch64.rpm
100100
elfutils-libelf-devel-static-0.189-6.azl3.aarch64.rpm
101101
elfutils-libelf-lang-0.189-6.azl3.aarch64.rpm
102-
expat-2.6.4-3.azl3.aarch64.rpm
103-
expat-devel-2.6.4-3.azl3.aarch64.rpm
104-
expat-libs-2.6.4-3.azl3.aarch64.rpm
102+
expat-2.6.4-4.azl3.aarch64.rpm
103+
expat-devel-2.6.4-4.azl3.aarch64.rpm
104+
expat-libs-2.6.4-4.azl3.aarch64.rpm
105105
libpipeline-1.5.7-1.azl3.aarch64.rpm
106106
libpipeline-devel-1.5.7-1.azl3.aarch64.rpm
107107
gdbm-1.23-1.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,9 @@ elfutils-libelf-0.189-6.azl3.x86_64.rpm
9999
elfutils-libelf-devel-0.189-6.azl3.x86_64.rpm
100100
elfutils-libelf-devel-static-0.189-6.azl3.x86_64.rpm
101101
elfutils-libelf-lang-0.189-6.azl3.x86_64.rpm
102-
expat-2.6.4-3.azl3.x86_64.rpm
103-
expat-devel-2.6.4-3.azl3.x86_64.rpm
104-
expat-libs-2.6.4-3.azl3.x86_64.rpm
102+
expat-2.6.4-4.azl3.x86_64.rpm
103+
expat-devel-2.6.4-4.azl3.x86_64.rpm
104+
expat-libs-2.6.4-4.azl3.x86_64.rpm
105105
libpipeline-1.5.7-1.azl3.x86_64.rpm
106106
libpipeline-devel-1.5.7-1.azl3.x86_64.rpm
107107
gdbm-1.23-1.azl3.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -94,10 +94,10 @@ elfutils-libelf-0.189-6.azl3.aarch64.rpm
9494
elfutils-libelf-devel-0.189-6.azl3.aarch64.rpm
9595
elfutils-libelf-devel-static-0.189-6.azl3.aarch64.rpm
9696
elfutils-libelf-lang-0.189-6.azl3.aarch64.rpm
97-
expat-2.6.4-3.azl3.aarch64.rpm
98-
expat-debuginfo-2.6.4-3.azl3.aarch64.rpm
99-
expat-devel-2.6.4-3.azl3.aarch64.rpm
100-
expat-libs-2.6.4-3.azl3.aarch64.rpm
97+
expat-2.6.4-4.azl3.aarch64.rpm
98+
expat-debuginfo-2.6.4-4.azl3.aarch64.rpm
99+
expat-devel-2.6.4-4.azl3.aarch64.rpm
100+
expat-libs-2.6.4-4.azl3.aarch64.rpm
101101
file-5.45-1.azl3.aarch64.rpm
102102
file-debuginfo-5.45-1.azl3.aarch64.rpm
103103
file-devel-5.45-1.azl3.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -99,10 +99,10 @@ elfutils-libelf-0.189-6.azl3.x86_64.rpm
9999
elfutils-libelf-devel-0.189-6.azl3.x86_64.rpm
100100
elfutils-libelf-devel-static-0.189-6.azl3.x86_64.rpm
101101
elfutils-libelf-lang-0.189-6.azl3.x86_64.rpm
102-
expat-2.6.4-3.azl3.x86_64.rpm
103-
expat-debuginfo-2.6.4-3.azl3.x86_64.rpm
104-
expat-devel-2.6.4-3.azl3.x86_64.rpm
105-
expat-libs-2.6.4-3.azl3.x86_64.rpm
102+
expat-2.6.4-4.azl3.x86_64.rpm
103+
expat-debuginfo-2.6.4-4.azl3.x86_64.rpm
104+
expat-devel-2.6.4-4.azl3.x86_64.rpm
105+
expat-libs-2.6.4-4.azl3.x86_64.rpm
106106
file-5.45-1.azl3.x86_64.rpm
107107
file-debuginfo-5.45-1.azl3.x86_64.rpm
108108
file-devel-5.45-1.azl3.x86_64.rpm

0 commit comments

Comments
 (0)