Summary
It was discovered that Expat, contained with the xmltok library did not
correctly handle certain integer arithmetic. If a user or automated
system were tricked into opening a specially crafted file, an attacker
could possibly cause a denial of service. (CVE-2026-56404, CVE-2026-56405)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libxmltok | 1.2-3ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libxmltok | 1.2-4ubuntu0.18.04.1~esm7 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libxmltok | 1.2-4ubuntu0.20.04.1~esm7 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libxmltok | 1.2-4ubuntu0.22.04.1~esm7 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | libxmltok | 1.2-4.1ubuntu2.24.0.4.1+esm5 |
Vulnerabilities 2
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in addBinding.
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in getAttributeId.