Debian Expat vulnerabilities

CVE-2012-0876 [MEDIUM] CVE-2012-0876: expat - The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without r... The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value. Scope: local bookworm: resolved (fixed in 2.1.0~beta3-1) bullseye: resolved (fix

CVE-2026-32777 [MEDIUM] CVE-2026-32777: expat - libexpat before 2.7.5 allows an infinite loop while parsing DTD content. libexpat before 2.7.5 allows an infinite loop while parsing DTD content. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.7.5-1) sid: resolved (fixed in 2.7.5-1) trixie: open

CVE-2026-32776 [MEDIUM] CVE-2026-32776: expat - libexpat before 2.7.5 allows a NULL pointer dereference with empty external para... libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.7.5-1) sid: resolved (fixed in 2.7.5-1) trixie: open

CVE-2026-32778 [LOW] CVE-2026-32778: expat - libexpat before 2.7.5 allows a NULL pointer dereference in the function setConte... libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.7.5-1) sid: resolved (fixed in 2.7.5-1) trixie: open

CVE-2026-24515 [LOW] CVE-2026-24515: expat - In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown e... In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2.7.3-2) sid: resolved (fixed in 2.7.3-2) trixie: open