Summary
It was discovered that Expat, contained within the xmltok library, incorrectly
handled the initialization of parsers for external entities. An attacker could
possibly use this issue to cause a denial of service. (CVE-2026-24515)
It was discovered that Expat, contained within the xmltok library, incorrectly
handled integer calculations when allocating memory for XML tags. An attacker
could possibly use this issue to cause a denial of service or execute arbitrary
code. (CVE-2026-25210)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libxmltok | 1.2-3ubuntu0.16.04.1~esm5 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libxmltok | 1.2-4ubuntu0.18.04.1~esm6 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libxmltok | 1.2-4ubuntu0.20.04.1~esm6 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libxmltok | 1.2-4ubuntu0.22.04.1~esm6 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | libxmltok | 1.2-4.1ubuntu2.24.0.4.1+esm4 |