Mastodawn

🔎 CVE-2025-59375: HIGH severity in libexpat (<2.7.2) — attackers can remotely exhaust system memory via crafted small XML docs, causing DoS. Patch to 2.7.2+ or mitigate with input controls. https://radar.offseq.com/threat/cve-2025-59375-cwe-770-allocation-of-resources-wit-82d0797d #OffSeq #Vuln #libexpat #InfoSec

Expat XML parser

Recursion kills: The story behind CVE-2024-8176 in libexpat

XAMPP is not secure. Contribute to Neustradamus/xampp development by creating an account on GitHub.

GitHub

Oh, my! https://libexpat.github.io/doc/users/ yes, many of these projects are insignificant or obsolete, but what remains! If these got broken! Oh, sh*! #FLOSS #libexpat #SBOM #vulnerability #XML

Expat XML parser

Unpopular opinion: If your hobby is responsible for running the modern world, you deserve to be paid a living wage for running it.

Any experienced C developers among my followers? #BoostsWelcome.

Expat, arguably the world's most popular #XML parser, is understaffed and without funding. As #xz has shown, situations like this are dangerous.

Last month, maintainer Sebastian Pipping put up a plea for help at https://github.com/libexpat/libexpat/blob/R_2_6_2/expat/Changes

(I would help myself, but my C skills barely surpass "Hello, World".)

:herb: Fast streaming XML parser written in C99 with >90% test coverage; moved from SourceForge to GitHub - libexpat/libexpat

GitHub

Контр-пример: нашли UAF - исправили UAF, а не “замылили” ошибку карантином.

OpenBSD 7.1 errata 010, September 23, 2022:

In libexpat fix heap use-after-free vulnerability CVE-2022-40674.

P.S. У всех пользователей #OpenBSD отличный повод запустить syspatch

Eine Sicherheitslücke in der Expat-Bibliothek zur Verarbeitung von XML könnten Angreifer nutzen, um in verwundbare Systeme einzudringen.
XML-Parser Expat ermöglicht Angreifern Einschleusen von Schadcode

Eine Sicherheitslücke in der Expat-Bibliothek zur Verarbeitung von XML könnten Angreifer nutzen, um in verwundbare Systeme einzudringen.

heise online