Expat 2.4.5 released, includes security fixes
libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, precisely C99. It is cross-platform and licensed under the MIT license.
Expat 2.4.5 has been released a few hours ago. This release is about security fixes. There are 5 CVEs involved:
Regarding impact of vulnerabilities, please note that looking at a vulnerability in isolation may miss part of the picture; e.g. if Expat passes malformed data to the application using Expat and that application isn't preprared for Expat violating their agreed API contract, you may end up with code execution from something that looked close to harmless, in isolation.
For more details, please check out the change log.
If you maintain Expat packaging or a bundled copy of Expat or a pinned version of Expat somewhere, please update to 2.4.5. Thank you!
Sebastian Pipping