<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="4">
<package pkgid="5ec2e6aec21db791863abaed853d9d22cbc982c82e3d7bcbfcc1cd498a8694f3bda20452b8343a84e5ce62139e489eca839701ce3a5b77b814090a3251192930" name="expat" arch="aarch64">
  <version epoch="0" ver="2.7.1" rel="160000.3.14.1"/>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1645358400">- update to 2.4.6 (bsc#1196168, CVE-2022-25313):
  * Bug fixes:
  - Fix a regression introduced by the fix for CVE-2022-25313
    in release 2.4.5 that affects applications that (1)
    call function XML_SetElementDeclHandler and (2) are
    parsing XML that contains nested element declarations
    (e.g. "&lt;!ELEMENT junk ((bar|foo|xyz+), zebra*)&gt;").
  - Version info bumped from 9:5:8 to 9:6:8;
    see https://verbump.de/ for what these numbers do.</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1646481600">- update to 2.4.7 (bsc#1196784, CVE-2022-25236):
  * Bug fixes:
  - Relax fix to CVE-2022-25236 (introduced with release 2.4.5)
    with regard to all valid URI characters (RFC 3986),
    i.e. the following set (excluding whitespace):
    ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz
    0123456789 % -._~ :/?#[]@ !$&amp;'()*+,;=
  * Other changes:
  - CMake|Windows: Store Expat version in the DLL
  - Document consequences of namespace separator choices not just
    in doc/reference.html but also in header &lt;expat.h&gt;
  - Document Expat's lack of validation of namespace URIs against
    RFC 3986, and that the XML 1.0r4 specification doesn't
    require Expat to validate namespace URIs, and that Expat
    may do more in that regard in future releases.
    If you find need for strict RFC 3986 URI validation on
    application level today, https://uriparser.github.io/ may
    be of interest.
  - Fix documentation of XML_EndDoctypeDeclHandler in &lt;expat.h&gt;
  - Document that a call to XML_FreeContentModel can be done at
    a later time from outside the element declaration handler
  - Make hardcoded namespace URIs easier to find in code
  - Update documentation on use of XML_POOR_ENTOPY on Solaris
  - tests: Resolve use of macros NAN and INFINITY for GNU G++
    4.8.2 on Solaris.
  - Version info bumped from 9:6:8 to 9:7:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1648555200">- update to 2.4.8:
  * Other changes:
  - pkg-config: Move "-lm" to section "Libs.private"
  - CMake|MSVC: Fix pkg-config section "Libs"
  - CMake|macOS: Start using linker arguments
    "-compatibility_version &lt;version&gt;" and
    "-current_version &lt;version&gt;" in a way compatible with GNU
    Libtool
  - Version info bumped from 9:7:8 to 9:8:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1663675200">- update to 2.4.9: (bsc#1203438)
  * Security fixes:
  - CVE-2022-40674 -- Heap use-after-free vulnerability in
    function doContent. Expected impact is denial of service
    or potentially arbitrary code execution.
  * Bug fixes:
  - MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
  - docs: Fix documentation on effect of switch XML_DTD on
    symbol visibility in doc/reference.html
  * Other changes:
  - MinGW: Make fix-xmltest-log.sh drop more Wine bug output
  - Autotools: Sync CMake templates with CMake 3.22
  - CMake: Migrate from use of CMAKE_*_POSTFIX to
    dedicated variables EXPAT_*_POSTFIX to stop affecting
    other projects
  - Windows|CMake: Add missing -DXML_STATIC to test runners
    and fuzzers
  - Windows|CMake: Render .def file from a template to fix
    linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON
  - MinGW|CMake: Apply MSVC .def file when linking
  - MinGW|CMake: Sync library name with GNU Autotools,
    i.e. produce libexpat-1.dll rather than libexpat.dll
    by default.  Filename libexpat.dll.a is unaffected.
  - MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in
    toolchain file "cmake/mingw-toolchain.cmake" to avoid
    error "windres: Command not found" on e.g. Ubuntu 20.04
  - CMake: Unify inconsistent use of set() and option() in
    context of public build time options to take need for
    set(.. FORCE) in projects using Expat by means of
    add_subdirectory(..) off Expat's users' shoulders
  - Stop exporting API symbols when building a static library
  - Resolve use of deprecated "fgrep" by "grep -F"
  - CMake: Make documentation on variables a bit more consistent
  - CMake: Drop leading whitespace from a #cmakedefine line in
    file expat_config.h.cmake
  - xmlwf: Fix harmless variable mix-up in function nsattcmp
  - Address Cppcheck warnings
  - Address Clang 15 compiler warnings
  - Version info bumped from 9:8:8 to 9:9:8;
    see https://verbump.de/ for what these numbers do
  * Infrastructure:
  - CI: Windows: Start covering MSVC 2022
  - CI: macOS: Migrate off deprecated macOS 10.15
  - CI: Linux: Make migration off deprecated Ubuntu 18.04 work
  - CI: Upgrade Clang from 14 to 15
  - apply-clang-format.sh: Add support for BSD find
  - coverage.sh: Exclude MinGW headers
  - coverage.sh: Fix name collision for -funsigned-char</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1666785600">- Update to 2.5.0: (bsc#1204708)
  * Security fixes:
  - CVE-2022-43680 -- Fix heap use-after-free after overeager
    destruction of a shared DTD in function
    XML_ExternalEntityParserCreate in out-of-memory situations.
    Expected impact is denial of service or potentially arbitrary
    code execution.
  * Bug fixes:
  - Fix curruption from undefined entities
  - Fix case when parsing was suspended while processing nested
    entities
  - Stop leaking opening tag bindings after a closing tag mismatch
    error where a parser is reset through XML_ParserReset and then
    reused to parse
  - CMake: Fix generation of pkg-config file
  - MinGW|CMake: Fix static library name
  * Other changes:
  - Protect header expat_config.h from multiple inclusion
  - examples: Make use of XML_GetBuffer and be more consistent
    across examples
  - Address compiler warnings
  - Version info bumped from 9:9:8 to 9:10:8; see
    https://verbump.de/ for what these numbers do</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1670760000">- add upstream signing key and validate source signature</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1707739200">- Update keyring automatically from keyserver during OBS service run.
- Explicitly use --without-docbook (before it was implicit).
- Include missing files for documentation and examples.
- Add manpage for xmlwf, which is now available in the released tarball.
- Clean the spec file a bit.
- Update to 2.6.0:
  * Security fixes:
  - CVE-2023-52425 (boo#1219559)
  - - Fix quadratic runtime issues with big tokens
    that can cause denial of service, in partial where
    dealing with compressed XML input.  Applications
    that parsed a document in one go -- a single call to
    functions XML_Parse or XML_ParseBuffer -- were not affected.
    The smaller the chunks/buffers you use for parsing
    previously, the bigger the problem prior to the fix.
    Backporters should be careful to no omit parts of
    pull request #789 and to include earlier pull request #771,
    in order to not break the fix.
  - CVE-2023-52426 (boo#1219561)
  - - Fix billion laughs attacks for users
    compiling *without* XML_DTD defined (which is not common).
    Users with XML_DTD defined have been protected since
    Expat &gt;=2.4.0 (and that was CVE-2013-0340 back then).
  * Bug fixes:
  - Fix parse-size-dependent "invalid token" error for
    external entities that start with a byte order mark
  - Fix NULL pointer dereference in setContext via
    XML_ExternalEntityParserCreate for compilation with
    XML_DTD undefined
  - Protect against closing entities out of order
  * Other changes:
  - Improve support for arc4random/arc4random_buf
  - Improve buffer growth in XML_GetBuffer and XML_Parse
  - xmlwf: Support --help and --version
  - xmlwf: Support custom buffer size for XML_GetBuffer and read
  - xmlwf: Improve language and URL clickability in help output
  - examples: Add new example "element_declarations.c"
  - Be stricter about macro XML_CONTEXT_BYTES at build time
  - Make inclusion to expat_config.h consistent
  - Autotools: configure.ac: Support --disable-maintainer-mode
  - Autotools: Sync CMake templates with CMake 3.26
  - Autotools: Make installation of shipped man page doc/xmlwf.1
    independent of docbook2man availability
  - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
    section "Cflags.private" in order to fix compilation
    against static libexpat using pkg-config on Windows
  - Autotools|CMake: Require a C99 compiler
    (a de-facto requirement already since Expat 2.2.2 of 2017)
  - Autotools|CMake: Fix PACKAGE_BUGREPORT variable
  - Autotools|CMake: Make test suite require a C++11 compiler
  - CMake: Require CMake &gt;=3.5.0
  - CMake: Lowercase off_t and size_t to help a bug in Meson
  - CMake: Sort xmlwf sources alphabetically
  - CMake|Windows: Fix generation of DLL file version info
  - CMake: Build tests/benchmark/benchmark.c as well for
    a build with -DEXPAT_BUILD_TESTS=ON
  - docs: Document the importance of isFinal + adjust tests
    accordingly
  - docs: Improve use of "NULL" and "null"
  - docs: Be specific about version of XML (XML 1.0r4)
    and version of C (C99); (XML 1.0r5 will need a sponsor.)
  - docs: reference.html: Promote function XML_ParseBuffer more
  - docs: reference.html: Add HTML anchors to XML_* macros
  - docs: reference.html: Upgrade to OK.css 1.2.0
  - docs: Fix typos
  - docs|CI: Use HTTPS URLs instead of HTTP at various places
  - Address compiler warnings
  - Address clang-tidy warnings
  - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1708430400">- Fix handling of xmlwf.1 to avoid workarounds in specfile:
  * Added libxml2-fix-xmlwf.1-handling.patch
- Call buildconf.sh to avoid (future) issues with expat_config.h.in</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1709294400">- update to 2.6.1:
  * Expose billion laughs API with XML_DTD defined and XML_GE
    undefined, regression from 2.6.0
  * Make tests independent of CPU speed, and thus more robust
- drop libxml2-fix-xmlwf.1-handling.patch, upstream</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1710331200">- update to 2.6.2:
  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated
    use of external parsers (boo#1221289)
  * Reject direct parameter entity recursion and avoid the related
    undefined behavior</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1725537600">- Update to 2.6.3:
  * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len &lt; 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio &lt;=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1727352000">- updated keyring [https://build.suse.de/request/show/345282]
- modified sources
  % expat.keyring</changelog>
  <changelog author="pgajdos@suse.com" date="1730980800">- version update to 2.6.4
  * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
  * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake &gt;=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
  [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
  [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1731412800">- no source changes, just adding jira reference: jsc#SLE-21253</changelog>
  <changelog author="pgajdos@suse.com" date="1741953600">- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
  * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("&lt;e&gt;&amp;g1;&lt;/e&gt;")
  - general entities in attribute values ("&lt;e k1='&amp;g1;'/&gt;")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
  * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
  [#945] #962 #966  CMake: Drop support for CMake &lt;3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1743076800">- version update to 2.7.0 for SLE-15-SP7 (jsc#PED-12507)</changelog>
  <changelog author="pgajdos@suse.com" date="1743163200">- version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives</changelog>
  <changelog author="Martin Schreiner &lt;martin.schreiner@suse.com&gt;" date="1759147200">- Fix CVE-2025-59375 / bsc#1249584.
- Add patch file:
  * CVE-2025-59375.patch</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1770120000">- security update
- added patches
  CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
  * expat-CVE-2026-24515.patch
  CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
  * expat-CVE-2026-25210.patch</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1774526400">- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch</changelog>
</package>
<package pkgid="d1fd72291f63bb2b340d7d1ce8c1f670850e315bafb221eb16f4d70afe0b5ae2c211788ad0c6bcaf9a1cf4688492490df0a4c78c7b3b36236ee744ac37c15bbd" name="expat" arch="src">
  <version epoch="0" ver="2.7.1" rel="160000.3.14.1"/>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1645358400">- update to 2.4.6 (bsc#1196168, CVE-2022-25313):
  * Bug fixes:
  - Fix a regression introduced by the fix for CVE-2022-25313
    in release 2.4.5 that affects applications that (1)
    call function XML_SetElementDeclHandler and (2) are
    parsing XML that contains nested element declarations
    (e.g. "&lt;!ELEMENT junk ((bar|foo|xyz+), zebra*)&gt;").
  - Version info bumped from 9:5:8 to 9:6:8;
    see https://verbump.de/ for what these numbers do.</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1646481600">- update to 2.4.7 (bsc#1196784, CVE-2022-25236):
  * Bug fixes:
  - Relax fix to CVE-2022-25236 (introduced with release 2.4.5)
    with regard to all valid URI characters (RFC 3986),
    i.e. the following set (excluding whitespace):
    ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz
    0123456789 % -._~ :/?#[]@ !$&amp;'()*+,;=
  * Other changes:
  - CMake|Windows: Store Expat version in the DLL
  - Document consequences of namespace separator choices not just
    in doc/reference.html but also in header &lt;expat.h&gt;
  - Document Expat's lack of validation of namespace URIs against
    RFC 3986, and that the XML 1.0r4 specification doesn't
    require Expat to validate namespace URIs, and that Expat
    may do more in that regard in future releases.
    If you find need for strict RFC 3986 URI validation on
    application level today, https://uriparser.github.io/ may
    be of interest.
  - Fix documentation of XML_EndDoctypeDeclHandler in &lt;expat.h&gt;
  - Document that a call to XML_FreeContentModel can be done at
    a later time from outside the element declaration handler
  - Make hardcoded namespace URIs easier to find in code
  - Update documentation on use of XML_POOR_ENTOPY on Solaris
  - tests: Resolve use of macros NAN and INFINITY for GNU G++
    4.8.2 on Solaris.
  - Version info bumped from 9:6:8 to 9:7:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1648555200">- update to 2.4.8:
  * Other changes:
  - pkg-config: Move "-lm" to section "Libs.private"
  - CMake|MSVC: Fix pkg-config section "Libs"
  - CMake|macOS: Start using linker arguments
    "-compatibility_version &lt;version&gt;" and
    "-current_version &lt;version&gt;" in a way compatible with GNU
    Libtool
  - Version info bumped from 9:7:8 to 9:8:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1663675200">- update to 2.4.9: (bsc#1203438)
  * Security fixes:
  - CVE-2022-40674 -- Heap use-after-free vulnerability in
    function doContent. Expected impact is denial of service
    or potentially arbitrary code execution.
  * Bug fixes:
  - MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
  - docs: Fix documentation on effect of switch XML_DTD on
    symbol visibility in doc/reference.html
  * Other changes:
  - MinGW: Make fix-xmltest-log.sh drop more Wine bug output
  - Autotools: Sync CMake templates with CMake 3.22
  - CMake: Migrate from use of CMAKE_*_POSTFIX to
    dedicated variables EXPAT_*_POSTFIX to stop affecting
    other projects
  - Windows|CMake: Add missing -DXML_STATIC to test runners
    and fuzzers
  - Windows|CMake: Render .def file from a template to fix
    linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON
  - MinGW|CMake: Apply MSVC .def file when linking
  - MinGW|CMake: Sync library name with GNU Autotools,
    i.e. produce libexpat-1.dll rather than libexpat.dll
    by default.  Filename libexpat.dll.a is unaffected.
  - MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in
    toolchain file "cmake/mingw-toolchain.cmake" to avoid
    error "windres: Command not found" on e.g. Ubuntu 20.04
  - CMake: Unify inconsistent use of set() and option() in
    context of public build time options to take need for
    set(.. FORCE) in projects using Expat by means of
    add_subdirectory(..) off Expat's users' shoulders
  - Stop exporting API symbols when building a static library
  - Resolve use of deprecated "fgrep" by "grep -F"
  - CMake: Make documentation on variables a bit more consistent
  - CMake: Drop leading whitespace from a #cmakedefine line in
    file expat_config.h.cmake
  - xmlwf: Fix harmless variable mix-up in function nsattcmp
  - Address Cppcheck warnings
  - Address Clang 15 compiler warnings
  - Version info bumped from 9:8:8 to 9:9:8;
    see https://verbump.de/ for what these numbers do
  * Infrastructure:
  - CI: Windows: Start covering MSVC 2022
  - CI: macOS: Migrate off deprecated macOS 10.15
  - CI: Linux: Make migration off deprecated Ubuntu 18.04 work
  - CI: Upgrade Clang from 14 to 15
  - apply-clang-format.sh: Add support for BSD find
  - coverage.sh: Exclude MinGW headers
  - coverage.sh: Fix name collision for -funsigned-char</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1666785600">- Update to 2.5.0: (bsc#1204708)
  * Security fixes:
  - CVE-2022-43680 -- Fix heap use-after-free after overeager
    destruction of a shared DTD in function
    XML_ExternalEntityParserCreate in out-of-memory situations.
    Expected impact is denial of service or potentially arbitrary
    code execution.
  * Bug fixes:
  - Fix curruption from undefined entities
  - Fix case when parsing was suspended while processing nested
    entities
  - Stop leaking opening tag bindings after a closing tag mismatch
    error where a parser is reset through XML_ParserReset and then
    reused to parse
  - CMake: Fix generation of pkg-config file
  - MinGW|CMake: Fix static library name
  * Other changes:
  - Protect header expat_config.h from multiple inclusion
  - examples: Make use of XML_GetBuffer and be more consistent
    across examples
  - Address compiler warnings
  - Version info bumped from 9:9:8 to 9:10:8; see
    https://verbump.de/ for what these numbers do</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1670760000">- add upstream signing key and validate source signature</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1707739200">- Update keyring automatically from keyserver during OBS service run.
- Explicitly use --without-docbook (before it was implicit).
- Include missing files for documentation and examples.
- Add manpage for xmlwf, which is now available in the released tarball.
- Clean the spec file a bit.
- Update to 2.6.0:
  * Security fixes:
  - CVE-2023-52425 (boo#1219559)
  - - Fix quadratic runtime issues with big tokens
    that can cause denial of service, in partial where
    dealing with compressed XML input.  Applications
    that parsed a document in one go -- a single call to
    functions XML_Parse or XML_ParseBuffer -- were not affected.
    The smaller the chunks/buffers you use for parsing
    previously, the bigger the problem prior to the fix.
    Backporters should be careful to no omit parts of
    pull request #789 and to include earlier pull request #771,
    in order to not break the fix.
  - CVE-2023-52426 (boo#1219561)
  - - Fix billion laughs attacks for users
    compiling *without* XML_DTD defined (which is not common).
    Users with XML_DTD defined have been protected since
    Expat &gt;=2.4.0 (and that was CVE-2013-0340 back then).
  * Bug fixes:
  - Fix parse-size-dependent "invalid token" error for
    external entities that start with a byte order mark
  - Fix NULL pointer dereference in setContext via
    XML_ExternalEntityParserCreate for compilation with
    XML_DTD undefined
  - Protect against closing entities out of order
  * Other changes:
  - Improve support for arc4random/arc4random_buf
  - Improve buffer growth in XML_GetBuffer and XML_Parse
  - xmlwf: Support --help and --version
  - xmlwf: Support custom buffer size for XML_GetBuffer and read
  - xmlwf: Improve language and URL clickability in help output
  - examples: Add new example "element_declarations.c"
  - Be stricter about macro XML_CONTEXT_BYTES at build time
  - Make inclusion to expat_config.h consistent
  - Autotools: configure.ac: Support --disable-maintainer-mode
  - Autotools: Sync CMake templates with CMake 3.26
  - Autotools: Make installation of shipped man page doc/xmlwf.1
    independent of docbook2man availability
  - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
    section "Cflags.private" in order to fix compilation
    against static libexpat using pkg-config on Windows
  - Autotools|CMake: Require a C99 compiler
    (a de-facto requirement already since Expat 2.2.2 of 2017)
  - Autotools|CMake: Fix PACKAGE_BUGREPORT variable
  - Autotools|CMake: Make test suite require a C++11 compiler
  - CMake: Require CMake &gt;=3.5.0
  - CMake: Lowercase off_t and size_t to help a bug in Meson
  - CMake: Sort xmlwf sources alphabetically
  - CMake|Windows: Fix generation of DLL file version info
  - CMake: Build tests/benchmark/benchmark.c as well for
    a build with -DEXPAT_BUILD_TESTS=ON
  - docs: Document the importance of isFinal + adjust tests
    accordingly
  - docs: Improve use of "NULL" and "null"
  - docs: Be specific about version of XML (XML 1.0r4)
    and version of C (C99); (XML 1.0r5 will need a sponsor.)
  - docs: reference.html: Promote function XML_ParseBuffer more
  - docs: reference.html: Add HTML anchors to XML_* macros
  - docs: reference.html: Upgrade to OK.css 1.2.0
  - docs: Fix typos
  - docs|CI: Use HTTPS URLs instead of HTTP at various places
  - Address compiler warnings
  - Address clang-tidy warnings
  - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1708430400">- Fix handling of xmlwf.1 to avoid workarounds in specfile:
  * Added libxml2-fix-xmlwf.1-handling.patch
- Call buildconf.sh to avoid (future) issues with expat_config.h.in</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1709294400">- update to 2.6.1:
  * Expose billion laughs API with XML_DTD defined and XML_GE
    undefined, regression from 2.6.0
  * Make tests independent of CPU speed, and thus more robust
- drop libxml2-fix-xmlwf.1-handling.patch, upstream</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1710331200">- update to 2.6.2:
  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated
    use of external parsers (boo#1221289)
  * Reject direct parameter entity recursion and avoid the related
    undefined behavior</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1725537600">- Update to 2.6.3:
  * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len &lt; 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio &lt;=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1727352000">- updated keyring [https://build.suse.de/request/show/345282]
- modified sources
  % expat.keyring</changelog>
  <changelog author="pgajdos@suse.com" date="1730980800">- version update to 2.6.4
  * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
  * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake &gt;=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
  [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
  [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1731412800">- no source changes, just adding jira reference: jsc#SLE-21253</changelog>
  <changelog author="pgajdos@suse.com" date="1741953600">- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
  * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("&lt;e&gt;&amp;g1;&lt;/e&gt;")
  - general entities in attribute values ("&lt;e k1='&amp;g1;'/&gt;")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
  * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
  [#945] #962 #966  CMake: Drop support for CMake &lt;3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1743076800">- version update to 2.7.0 for SLE-15-SP7 (jsc#PED-12507)</changelog>
  <changelog author="pgajdos@suse.com" date="1743163200">- version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives</changelog>
  <changelog author="Martin Schreiner &lt;martin.schreiner@suse.com&gt;" date="1759147200">- Fix CVE-2025-59375 / bsc#1249584.
- Add patch file:
  * CVE-2025-59375.patch</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1770120000">- security update
- added patches
  CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
  * expat-CVE-2026-24515.patch
  CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
  * expat-CVE-2026-25210.patch</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1774526400">- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch</changelog>
</package>
<package pkgid="a6364459a74f3e5d936b23029f9f78478fa3d904a9aba4c9a3b7c14db080a103798e7ecf0f99c730e4c92decad4b53d919c4c3d89652da1914f1a5306b7b914a" name="libexpat-devel" arch="aarch64">
  <version epoch="0" ver="2.7.1" rel="160000.3.14.1"/>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1645358400">- update to 2.4.6 (bsc#1196168, CVE-2022-25313):
  * Bug fixes:
  - Fix a regression introduced by the fix for CVE-2022-25313
    in release 2.4.5 that affects applications that (1)
    call function XML_SetElementDeclHandler and (2) are
    parsing XML that contains nested element declarations
    (e.g. "&lt;!ELEMENT junk ((bar|foo|xyz+), zebra*)&gt;").
  - Version info bumped from 9:5:8 to 9:6:8;
    see https://verbump.de/ for what these numbers do.</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1646481600">- update to 2.4.7 (bsc#1196784, CVE-2022-25236):
  * Bug fixes:
  - Relax fix to CVE-2022-25236 (introduced with release 2.4.5)
    with regard to all valid URI characters (RFC 3986),
    i.e. the following set (excluding whitespace):
    ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz
    0123456789 % -._~ :/?#[]@ !$&amp;'()*+,;=
  * Other changes:
  - CMake|Windows: Store Expat version in the DLL
  - Document consequences of namespace separator choices not just
    in doc/reference.html but also in header &lt;expat.h&gt;
  - Document Expat's lack of validation of namespace URIs against
    RFC 3986, and that the XML 1.0r4 specification doesn't
    require Expat to validate namespace URIs, and that Expat
    may do more in that regard in future releases.
    If you find need for strict RFC 3986 URI validation on
    application level today, https://uriparser.github.io/ may
    be of interest.
  - Fix documentation of XML_EndDoctypeDeclHandler in &lt;expat.h&gt;
  - Document that a call to XML_FreeContentModel can be done at
    a later time from outside the element declaration handler
  - Make hardcoded namespace URIs easier to find in code
  - Update documentation on use of XML_POOR_ENTOPY on Solaris
  - tests: Resolve use of macros NAN and INFINITY for GNU G++
    4.8.2 on Solaris.
  - Version info bumped from 9:6:8 to 9:7:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1648555200">- update to 2.4.8:
  * Other changes:
  - pkg-config: Move "-lm" to section "Libs.private"
  - CMake|MSVC: Fix pkg-config section "Libs"
  - CMake|macOS: Start using linker arguments
    "-compatibility_version &lt;version&gt;" and
    "-current_version &lt;version&gt;" in a way compatible with GNU
    Libtool
  - Version info bumped from 9:7:8 to 9:8:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1663675200">- update to 2.4.9: (bsc#1203438)
  * Security fixes:
  - CVE-2022-40674 -- Heap use-after-free vulnerability in
    function doContent. Expected impact is denial of service
    or potentially arbitrary code execution.
  * Bug fixes:
  - MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
  - docs: Fix documentation on effect of switch XML_DTD on
    symbol visibility in doc/reference.html
  * Other changes:
  - MinGW: Make fix-xmltest-log.sh drop more Wine bug output
  - Autotools: Sync CMake templates with CMake 3.22
  - CMake: Migrate from use of CMAKE_*_POSTFIX to
    dedicated variables EXPAT_*_POSTFIX to stop affecting
    other projects
  - Windows|CMake: Add missing -DXML_STATIC to test runners
    and fuzzers
  - Windows|CMake: Render .def file from a template to fix
    linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON
  - MinGW|CMake: Apply MSVC .def file when linking
  - MinGW|CMake: Sync library name with GNU Autotools,
    i.e. produce libexpat-1.dll rather than libexpat.dll
    by default.  Filename libexpat.dll.a is unaffected.
  - MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in
    toolchain file "cmake/mingw-toolchain.cmake" to avoid
    error "windres: Command not found" on e.g. Ubuntu 20.04
  - CMake: Unify inconsistent use of set() and option() in
    context of public build time options to take need for
    set(.. FORCE) in projects using Expat by means of
    add_subdirectory(..) off Expat's users' shoulders
  - Stop exporting API symbols when building a static library
  - Resolve use of deprecated "fgrep" by "grep -F"
  - CMake: Make documentation on variables a bit more consistent
  - CMake: Drop leading whitespace from a #cmakedefine line in
    file expat_config.h.cmake
  - xmlwf: Fix harmless variable mix-up in function nsattcmp
  - Address Cppcheck warnings
  - Address Clang 15 compiler warnings
  - Version info bumped from 9:8:8 to 9:9:8;
    see https://verbump.de/ for what these numbers do
  * Infrastructure:
  - CI: Windows: Start covering MSVC 2022
  - CI: macOS: Migrate off deprecated macOS 10.15
  - CI: Linux: Make migration off deprecated Ubuntu 18.04 work
  - CI: Upgrade Clang from 14 to 15
  - apply-clang-format.sh: Add support for BSD find
  - coverage.sh: Exclude MinGW headers
  - coverage.sh: Fix name collision for -funsigned-char</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1666785600">- Update to 2.5.0: (bsc#1204708)
  * Security fixes:
  - CVE-2022-43680 -- Fix heap use-after-free after overeager
    destruction of a shared DTD in function
    XML_ExternalEntityParserCreate in out-of-memory situations.
    Expected impact is denial of service or potentially arbitrary
    code execution.
  * Bug fixes:
  - Fix curruption from undefined entities
  - Fix case when parsing was suspended while processing nested
    entities
  - Stop leaking opening tag bindings after a closing tag mismatch
    error where a parser is reset through XML_ParserReset and then
    reused to parse
  - CMake: Fix generation of pkg-config file
  - MinGW|CMake: Fix static library name
  * Other changes:
  - Protect header expat_config.h from multiple inclusion
  - examples: Make use of XML_GetBuffer and be more consistent
    across examples
  - Address compiler warnings
  - Version info bumped from 9:9:8 to 9:10:8; see
    https://verbump.de/ for what these numbers do</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1670760000">- add upstream signing key and validate source signature</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1707739200">- Update keyring automatically from keyserver during OBS service run.
- Explicitly use --without-docbook (before it was implicit).
- Include missing files for documentation and examples.
- Add manpage for xmlwf, which is now available in the released tarball.
- Clean the spec file a bit.
- Update to 2.6.0:
  * Security fixes:
  - CVE-2023-52425 (boo#1219559)
  - - Fix quadratic runtime issues with big tokens
    that can cause denial of service, in partial where
    dealing with compressed XML input.  Applications
    that parsed a document in one go -- a single call to
    functions XML_Parse or XML_ParseBuffer -- were not affected.
    The smaller the chunks/buffers you use for parsing
    previously, the bigger the problem prior to the fix.
    Backporters should be careful to no omit parts of
    pull request #789 and to include earlier pull request #771,
    in order to not break the fix.
  - CVE-2023-52426 (boo#1219561)
  - - Fix billion laughs attacks for users
    compiling *without* XML_DTD defined (which is not common).
    Users with XML_DTD defined have been protected since
    Expat &gt;=2.4.0 (and that was CVE-2013-0340 back then).
  * Bug fixes:
  - Fix parse-size-dependent "invalid token" error for
    external entities that start with a byte order mark
  - Fix NULL pointer dereference in setContext via
    XML_ExternalEntityParserCreate for compilation with
    XML_DTD undefined
  - Protect against closing entities out of order
  * Other changes:
  - Improve support for arc4random/arc4random_buf
  - Improve buffer growth in XML_GetBuffer and XML_Parse
  - xmlwf: Support --help and --version
  - xmlwf: Support custom buffer size for XML_GetBuffer and read
  - xmlwf: Improve language and URL clickability in help output
  - examples: Add new example "element_declarations.c"
  - Be stricter about macro XML_CONTEXT_BYTES at build time
  - Make inclusion to expat_config.h consistent
  - Autotools: configure.ac: Support --disable-maintainer-mode
  - Autotools: Sync CMake templates with CMake 3.26
  - Autotools: Make installation of shipped man page doc/xmlwf.1
    independent of docbook2man availability
  - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
    section "Cflags.private" in order to fix compilation
    against static libexpat using pkg-config on Windows
  - Autotools|CMake: Require a C99 compiler
    (a de-facto requirement already since Expat 2.2.2 of 2017)
  - Autotools|CMake: Fix PACKAGE_BUGREPORT variable
  - Autotools|CMake: Make test suite require a C++11 compiler
  - CMake: Require CMake &gt;=3.5.0
  - CMake: Lowercase off_t and size_t to help a bug in Meson
  - CMake: Sort xmlwf sources alphabetically
  - CMake|Windows: Fix generation of DLL file version info
  - CMake: Build tests/benchmark/benchmark.c as well for
    a build with -DEXPAT_BUILD_TESTS=ON
  - docs: Document the importance of isFinal + adjust tests
    accordingly
  - docs: Improve use of "NULL" and "null"
  - docs: Be specific about version of XML (XML 1.0r4)
    and version of C (C99); (XML 1.0r5 will need a sponsor.)
  - docs: reference.html: Promote function XML_ParseBuffer more
  - docs: reference.html: Add HTML anchors to XML_* macros
  - docs: reference.html: Upgrade to OK.css 1.2.0
  - docs: Fix typos
  - docs|CI: Use HTTPS URLs instead of HTTP at various places
  - Address compiler warnings
  - Address clang-tidy warnings
  - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1708430400">- Fix handling of xmlwf.1 to avoid workarounds in specfile:
  * Added libxml2-fix-xmlwf.1-handling.patch
- Call buildconf.sh to avoid (future) issues with expat_config.h.in</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1709294400">- update to 2.6.1:
  * Expose billion laughs API with XML_DTD defined and XML_GE
    undefined, regression from 2.6.0
  * Make tests independent of CPU speed, and thus more robust
- drop libxml2-fix-xmlwf.1-handling.patch, upstream</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1710331200">- update to 2.6.2:
  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated
    use of external parsers (boo#1221289)
  * Reject direct parameter entity recursion and avoid the related
    undefined behavior</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1725537600">- Update to 2.6.3:
  * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len &lt; 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio &lt;=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1727352000">- updated keyring [https://build.suse.de/request/show/345282]
- modified sources
  % expat.keyring</changelog>
  <changelog author="pgajdos@suse.com" date="1730980800">- version update to 2.6.4
  * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
  * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake &gt;=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
  [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
  [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1731412800">- no source changes, just adding jira reference: jsc#SLE-21253</changelog>
  <changelog author="pgajdos@suse.com" date="1741953600">- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
  * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("&lt;e&gt;&amp;g1;&lt;/e&gt;")
  - general entities in attribute values ("&lt;e k1='&amp;g1;'/&gt;")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
  * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
  [#945] #962 #966  CMake: Drop support for CMake &lt;3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1743076800">- version update to 2.7.0 for SLE-15-SP7 (jsc#PED-12507)</changelog>
  <changelog author="pgajdos@suse.com" date="1743163200">- version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives</changelog>
  <changelog author="Martin Schreiner &lt;martin.schreiner@suse.com&gt;" date="1759147200">- Fix CVE-2025-59375 / bsc#1249584.
- Add patch file:
  * CVE-2025-59375.patch</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1770120000">- security update
- added patches
  CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
  * expat-CVE-2026-24515.patch
  CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
  * expat-CVE-2026-25210.patch</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1774526400">- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch</changelog>
</package>
<package pkgid="7352e6e50aaf3769df94f7534bc7c27ad573bd58da75655446dade6f1e76ca451f799c956d633818237ac7e32afa774b714decc3c6ba014a390e6353f382bc0e" name="libexpat1" arch="aarch64">
  <version epoch="0" ver="2.7.1" rel="160000.3.14.1"/>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1645358400">- update to 2.4.6 (bsc#1196168, CVE-2022-25313):
  * Bug fixes:
  - Fix a regression introduced by the fix for CVE-2022-25313
    in release 2.4.5 that affects applications that (1)
    call function XML_SetElementDeclHandler and (2) are
    parsing XML that contains nested element declarations
    (e.g. "&lt;!ELEMENT junk ((bar|foo|xyz+), zebra*)&gt;").
  - Version info bumped from 9:5:8 to 9:6:8;
    see https://verbump.de/ for what these numbers do.</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1646481600">- update to 2.4.7 (bsc#1196784, CVE-2022-25236):
  * Bug fixes:
  - Relax fix to CVE-2022-25236 (introduced with release 2.4.5)
    with regard to all valid URI characters (RFC 3986),
    i.e. the following set (excluding whitespace):
    ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz
    0123456789 % -._~ :/?#[]@ !$&amp;'()*+,;=
  * Other changes:
  - CMake|Windows: Store Expat version in the DLL
  - Document consequences of namespace separator choices not just
    in doc/reference.html but also in header &lt;expat.h&gt;
  - Document Expat's lack of validation of namespace URIs against
    RFC 3986, and that the XML 1.0r4 specification doesn't
    require Expat to validate namespace URIs, and that Expat
    may do more in that regard in future releases.
    If you find need for strict RFC 3986 URI validation on
    application level today, https://uriparser.github.io/ may
    be of interest.
  - Fix documentation of XML_EndDoctypeDeclHandler in &lt;expat.h&gt;
  - Document that a call to XML_FreeContentModel can be done at
    a later time from outside the element declaration handler
  - Make hardcoded namespace URIs easier to find in code
  - Update documentation on use of XML_POOR_ENTOPY on Solaris
  - tests: Resolve use of macros NAN and INFINITY for GNU G++
    4.8.2 on Solaris.
  - Version info bumped from 9:6:8 to 9:7:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1648555200">- update to 2.4.8:
  * Other changes:
  - pkg-config: Move "-lm" to section "Libs.private"
  - CMake|MSVC: Fix pkg-config section "Libs"
  - CMake|macOS: Start using linker arguments
    "-compatibility_version &lt;version&gt;" and
    "-current_version &lt;version&gt;" in a way compatible with GNU
    Libtool
  - Version info bumped from 9:7:8 to 9:8:8;
    see https://verbump.de/ for what these numbers do</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1663675200">- update to 2.4.9: (bsc#1203438)
  * Security fixes:
  - CVE-2022-40674 -- Heap use-after-free vulnerability in
    function doContent. Expected impact is denial of service
    or potentially arbitrary code execution.
  * Bug fixes:
  - MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
  - docs: Fix documentation on effect of switch XML_DTD on
    symbol visibility in doc/reference.html
  * Other changes:
  - MinGW: Make fix-xmltest-log.sh drop more Wine bug output
  - Autotools: Sync CMake templates with CMake 3.22
  - CMake: Migrate from use of CMAKE_*_POSTFIX to
    dedicated variables EXPAT_*_POSTFIX to stop affecting
    other projects
  - Windows|CMake: Add missing -DXML_STATIC to test runners
    and fuzzers
  - Windows|CMake: Render .def file from a template to fix
    linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON
  - MinGW|CMake: Apply MSVC .def file when linking
  - MinGW|CMake: Sync library name with GNU Autotools,
    i.e. produce libexpat-1.dll rather than libexpat.dll
    by default.  Filename libexpat.dll.a is unaffected.
  - MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in
    toolchain file "cmake/mingw-toolchain.cmake" to avoid
    error "windres: Command not found" on e.g. Ubuntu 20.04
  - CMake: Unify inconsistent use of set() and option() in
    context of public build time options to take need for
    set(.. FORCE) in projects using Expat by means of
    add_subdirectory(..) off Expat's users' shoulders
  - Stop exporting API symbols when building a static library
  - Resolve use of deprecated "fgrep" by "grep -F"
  - CMake: Make documentation on variables a bit more consistent
  - CMake: Drop leading whitespace from a #cmakedefine line in
    file expat_config.h.cmake
  - xmlwf: Fix harmless variable mix-up in function nsattcmp
  - Address Cppcheck warnings
  - Address Clang 15 compiler warnings
  - Version info bumped from 9:8:8 to 9:9:8;
    see https://verbump.de/ for what these numbers do
  * Infrastructure:
  - CI: Windows: Start covering MSVC 2022
  - CI: macOS: Migrate off deprecated macOS 10.15
  - CI: Linux: Make migration off deprecated Ubuntu 18.04 work
  - CI: Upgrade Clang from 14 to 15
  - apply-clang-format.sh: Add support for BSD find
  - coverage.sh: Exclude MinGW headers
  - coverage.sh: Fix name collision for -funsigned-char</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1666785600">- Update to 2.5.0: (bsc#1204708)
  * Security fixes:
  - CVE-2022-43680 -- Fix heap use-after-free after overeager
    destruction of a shared DTD in function
    XML_ExternalEntityParserCreate in out-of-memory situations.
    Expected impact is denial of service or potentially arbitrary
    code execution.
  * Bug fixes:
  - Fix curruption from undefined entities
  - Fix case when parsing was suspended while processing nested
    entities
  - Stop leaking opening tag bindings after a closing tag mismatch
    error where a parser is reset through XML_ParserReset and then
    reused to parse
  - CMake: Fix generation of pkg-config file
  - MinGW|CMake: Fix static library name
  * Other changes:
  - Protect header expat_config.h from multiple inclusion
  - examples: Make use of XML_GetBuffer and be more consistent
    across examples
  - Address compiler warnings
  - Version info bumped from 9:9:8 to 9:10:8; see
    https://verbump.de/ for what these numbers do</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1670760000">- add upstream signing key and validate source signature</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1707739200">- Update keyring automatically from keyserver during OBS service run.
- Explicitly use --without-docbook (before it was implicit).
- Include missing files for documentation and examples.
- Add manpage for xmlwf, which is now available in the released tarball.
- Clean the spec file a bit.
- Update to 2.6.0:
  * Security fixes:
  - CVE-2023-52425 (boo#1219559)
  - - Fix quadratic runtime issues with big tokens
    that can cause denial of service, in partial where
    dealing with compressed XML input.  Applications
    that parsed a document in one go -- a single call to
    functions XML_Parse or XML_ParseBuffer -- were not affected.
    The smaller the chunks/buffers you use for parsing
    previously, the bigger the problem prior to the fix.
    Backporters should be careful to no omit parts of
    pull request #789 and to include earlier pull request #771,
    in order to not break the fix.
  - CVE-2023-52426 (boo#1219561)
  - - Fix billion laughs attacks for users
    compiling *without* XML_DTD defined (which is not common).
    Users with XML_DTD defined have been protected since
    Expat &gt;=2.4.0 (and that was CVE-2013-0340 back then).
  * Bug fixes:
  - Fix parse-size-dependent "invalid token" error for
    external entities that start with a byte order mark
  - Fix NULL pointer dereference in setContext via
    XML_ExternalEntityParserCreate for compilation with
    XML_DTD undefined
  - Protect against closing entities out of order
  * Other changes:
  - Improve support for arc4random/arc4random_buf
  - Improve buffer growth in XML_GetBuffer and XML_Parse
  - xmlwf: Support --help and --version
  - xmlwf: Support custom buffer size for XML_GetBuffer and read
  - xmlwf: Improve language and URL clickability in help output
  - examples: Add new example "element_declarations.c"
  - Be stricter about macro XML_CONTEXT_BYTES at build time
  - Make inclusion to expat_config.h consistent
  - Autotools: configure.ac: Support --disable-maintainer-mode
  - Autotools: Sync CMake templates with CMake 3.26
  - Autotools: Make installation of shipped man page doc/xmlwf.1
    independent of docbook2man availability
  - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
    section "Cflags.private" in order to fix compilation
    against static libexpat using pkg-config on Windows
  - Autotools|CMake: Require a C99 compiler
    (a de-facto requirement already since Expat 2.2.2 of 2017)
  - Autotools|CMake: Fix PACKAGE_BUGREPORT variable
  - Autotools|CMake: Make test suite require a C++11 compiler
  - CMake: Require CMake &gt;=3.5.0
  - CMake: Lowercase off_t and size_t to help a bug in Meson
  - CMake: Sort xmlwf sources alphabetically
  - CMake|Windows: Fix generation of DLL file version info
  - CMake: Build tests/benchmark/benchmark.c as well for
    a build with -DEXPAT_BUILD_TESTS=ON
  - docs: Document the importance of isFinal + adjust tests
    accordingly
  - docs: Improve use of "NULL" and "null"
  - docs: Be specific about version of XML (XML 1.0r4)
    and version of C (C99); (XML 1.0r5 will need a sponsor.)
  - docs: reference.html: Promote function XML_ParseBuffer more
  - docs: reference.html: Add HTML anchors to XML_* macros
  - docs: reference.html: Upgrade to OK.css 1.2.0
  - docs: Fix typos
  - docs|CI: Use HTTPS URLs instead of HTTP at various places
  - Address compiler warnings
  - Address clang-tidy warnings
  - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1708430400">- Fix handling of xmlwf.1 to avoid workarounds in specfile:
  * Added libxml2-fix-xmlwf.1-handling.patch
- Call buildconf.sh to avoid (future) issues with expat_config.h.in</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1709294400">- update to 2.6.1:
  * Expose billion laughs API with XML_DTD defined and XML_GE
    undefined, regression from 2.6.0
  * Make tests independent of CPU speed, and thus more robust
- drop libxml2-fix-xmlwf.1-handling.patch, upstream</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1710331200">- update to 2.6.2:
  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated
    use of external parsers (boo#1221289)
  * Reject direct parameter entity recursion and avoid the related
    undefined behavior</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1725537600">- Update to 2.6.3:
  * Security fixes:
  - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with
    len &lt; 0 without noticing and then calling XML_GetBuffer
    will have XML_ParseBuffer fail to recognize the problem
    and XML_GetBuffer corrupt memory.
    With the fix, XML_ParseBuffer now complains with error
    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
    has been doing since Expat 2.2.1, and now documented.
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an
    integer overflow for nDefaultAtts on 32-bit platforms
    (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can
    have an integer overflow for m_groupSize on 32-bit
    platforms (where UINT_MAX equals SIZE_MAX).
    Impact is denial of service to potentially artitrary code
    execution.
  * Other changes:
  - Autotools: Sync CMake templates with CMake 3.28
  - Autotools: Always provide path to find(1) for portability
  - Autotools: Ensure that the m4 directory always exists.
  - Autotools: Simplify handling of SIZEOF_VOID_P
  - Autotools: Support non-GNU sed
  - Autotools|CMake: Fix main() to main(void)
  - Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
  - Autotools|CMake: Stop requiring dos2unix
  - CMake: Fix check for symbols size_t and off_t
  - docs|tests: Convert README to Markdown and update
  - Windows: Drop support for Visual Studio &lt;=15.0/2017
  - Drop needless XML_DTD guards around is_param access
  - Fix typo in a code comment
  - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1727352000">- updated keyring [https://build.suse.de/request/show/345282]
- modified sources
  % expat.keyring</changelog>
  <changelog author="pgajdos@suse.com" date="1730980800">- version update to 2.6.4
  * Security fixes: [bsc#1232601][bsc#1232579]
    [#915]  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
    from a NULL pointer dereference by disallowing function
    XML_StopParser to (stop or) suspend an unstarted parser.
    A new error code XML_ERROR_NOT_STARTED was introduced to
    properly communicate this situation.  // CWE-476 CWE-754
  * Other changes:
    [#903]  CMake: Add alias target "expat::expat"
    [#905]  docs: Document use via CMake &gt;=3.18 with FetchContent
    and SOURCE_SUBDIR and its consequences
    [#902]  tests: Reduce use of global parser instance
    [#904]  tests: Resolve duplicate handler
  [#317] #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
    [#914]  Fix signedness of format strings
  [#919] #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1731412800">- no source changes, just adding jira reference: jsc#SLE-21253</changelog>
  <changelog author="pgajdos@suse.com" date="1741953600">- version update to 2.7.0 (CVE-2024-8176 [bsc#1239618])
  * Security fixes:
    [#893] #973  CVE-2024-8176 -- Fix crash from chaining a large number
    of entities caused by stack overflow by resolving use of
    recursion, for all three uses of entities:
  - general entities in character data ("&lt;e&gt;&amp;g1;&lt;/e&gt;")
  - general entities in attribute values ("&lt;e k1='&amp;g1;'/&gt;")
  - parameter entities ("%p1;")
    Known impact is (reliable and easy) denial of service:
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
    (Base Score: 7.5, Temporal Score: 7.2)
    Please note that a layer of compression around XML can
    significantly reduce the minimum attack payload size.
  * Other changes:
    [#935] #937  Autotools: Make generated CMake files look for
    libexpat.@SO_MAJOR@.dylib on macOS
    [#925]  Autotools: Sync CMake templates with CMake 3.29
  [#945] #962 #966  CMake: Drop support for CMake &lt;3.13
    [#942]  CMake: Small fuzzing related improvements
    [#921]  docs: Add missing documentation of error code
    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
    [#941]  docs: Document need for C++11 compiler for use from C++
    [#959]  tests/benchmark: Fix a (harmless) TOCTTOU
    [#944]  Windows: Fix installer target location of file xmlwf.xml
    for CMake
    [#953]  Windows: Address warning -Wunknown-warning-option
    about -Wno-pedantic-ms-format from LLVM MinGW
    [#971]  Address Cppcheck warnings
    [#969] #970  Mass-migrate links from http:// to https://
    [#947] #958 ..
    [#974] #975  Document changes since the previous release
    [#974] #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do</changelog>
  <changelog author="pgajdos@suse.com" date="1743076800">- version update to 2.7.0 for SLE-15-SP7 (jsc#PED-12507)</changelog>
  <changelog author="pgajdos@suse.com" date="1743163200">- version update to 2.7.1
    Bug fixes:
    [#980] #989  Restore event pointer behavior from Expat 2.6.4
    (that the fix to CVE-2024-8176 changed in 2.7.0);
    affected API functions are:
  - XML_GetCurrentByteCount
  - XML_GetCurrentByteIndex
  - XML_GetCurrentColumnNumber
  - XML_GetCurrentLineNumber
  - XML_GetInputContext
    Other changes:
    [#976] #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
    with Automake that were missing from 2.7.0 release tarballs
    [#983] #984  Fix printf format specifiers for 32bit Emscripten
    [#992]  docs: Promote OpenSSF Best Practices self-certification
    [#978]  tests/benchmark: Resolve mistaken double close
    [#986]  Address compiler warnings
    [#990] #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
    for what these numbers do
    Infrastructure:
    [#982]  CI: Start running Perl XML::Parser integration tests
    [#987]  CI: Enforce Clang Static Analyzer clean code
    [#991]  CI: Re-enable warning clang-analyzer-valist.Uninitialized
    for clang-tidy
    [#981]  CI: Cover compilation with musl
    [#983] #984  CI: Cover compilation with 32bit Emscripten
    [#976] #977  CI: Protect against fuzzer files missing from future
    release archives</changelog>
  <changelog author="Martin Schreiner &lt;martin.schreiner@suse.com&gt;" date="1759147200">- Fix CVE-2025-59375 / bsc#1249584.
- Add patch file:
  * CVE-2025-59375.patch</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1770120000">- security update
- added patches
  CVE-2026-24515 [bsc#1257144], NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser
  * expat-CVE-2026-24515.patch
  CVE-2026-25210 [bsc#1257496], lack of buffer size check can lead to an integer overflow
  * expat-CVE-2026-25210.patch</changelog>
  <changelog author="David Anes &lt;david.anes@suse.com&gt;" date="1774526400">- security update:
  * CVE-2026-32776: expat: libexpat: NULL pointer dereference when
    processing empty external parameter entities inside an entity
    declaration value (bsc#1259726)
  - Added patch expat-CVE-2026-32776.patch
  * CVE-2026-32777: expat: libexpat: denial of service due to
    infinite loop in DTD content parsing (bsc#1259711)
  - Added patch expat-CVE-2026-32777.patch
  * CVE-2026-32778: expat: libexpat: NULL pointer dereference in
    `setContext` on retry after an out-of-memory condition (bsc#1259729)
  - Added patch expat-CVE-2026-32778.patch</changelog>
</package>
</otherdata>