version update to 2.7.4

expat-2.7.2.tar.xz.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCAAdFiEEy43nCpDPv2w79cxWliYqz/vTrsYFAmjJjAcACgkQliYqz/vT
-rsbRdRAAj9lKcun8hAC3pS3LueWJT46/Lb+yeuMbBdNLlTft6Scvb+WZGHP63lxX
-B4jv+qpPF5Yz5uUwa+h3BwYvQXRH7d1fzX1TdRDHLrvbid92EFjZ2lJSJ9Ihx1ql
-qfQCD7fZQyfIYV+IKIy4QrxAaQFnNc9NvXZ9runiiya9fd3Xx8u+UecPBGyqCAx+
-hMfp8uilLxeVd/P3N3aOJwsLaqrEp4alXX3sa5BCCLYT6Ei5/PuxQhRq0UMK9YMV
-O3hdxcAtYNRq5ZObTApnscn4APJdyF/pzUQQQCatm9MmCKPyxUpEId0X759mpJBH
-ZpqQLDQMdsNEp5MLNvMufMjaEWw9WfBvx/vy2o6WZZch+ObUMTBEiSAO/MozT9qe
-zKdeZaWQ8MMUP+6+t0H+Q45TP1qMIQirGqIkkgHLykes91HpumRyPyTR4+rR3siA
-2/IpzD5uuw/3XVFJiqLrmh0ILp/32CkaAiBZZ3oDUridGNk3yiyAAzUZEB54pmFf
-jXyX1qdN8R3xgtjNBXW+q+klJqu3Oifr1Ehl46BJAky9Ttysmh/WiHrdZaxSsTDZ
-9E7DpxKtQyV7x0vQOslQVTwyX+HFPYGZntOmqM0grsQ0hMSDDCBd0UJTwrYrtazX
-zE6GNDHzgd3sFaCwwJzvnxogXruQrHht0F5ZHEzcUStmtP86XRE=
-=rCmF
------END PGP SIGNATURE-----

expat-2.7.4.tar.xz.asc

@@ -0,0 +1,17 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAABCAA5FiEEy43nCpDPv2w79cxWliYqz/vTrsYFAml967kbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMiwyAAoJEJYmKs/7067G7AcQALg4k9deC50LsO68nWEr
+IfzQWkoglhJUK34wPrn4BiAp5YVczwWaQhtOGEBNL/sDs+g/cQ5bBFQCYpjPQes3
+ksMsr6JPwwCAE9bOPPJLTx7uFyBjZfdt2J6J4fpXpBdwumo6T2k56Pcd2nMeqa5+
+M/tvt/nxaD+lJVJ40opWreFW5xj+DNN3H0zHz6ulsB0p87r6mK0dAFWwazCCg6nr
+oKY0zdrIYeF81Dm5vBRR4sawWt8wJUR9K/L9EnxTHUyvHsDJuuFdGzHL8nKk5TxO
+eYaD2ADc8XPmK5Pd/OTkQfKr3L+ZRFf6jDbISt2jze9aCxXhiB+Xtzrw7TpXTEZv
+bSJbTb2EJnDVPpq8yiuPOeJsE6HTQW7q/XLPRazvhWijrkbcydgHyFY1WEAPfmvh
+tjrI90jnM9Kn5HbbsATBg6vRrjOTbJTiDolMp7f7mhZEMaDh4XZC+VhyabZMbJT+
+n8KIv20vJd06IPVg2g7cnntrIklQGbUMu+CgNSzswNCakS+1FuR2nieqeOVHUWjt
+7y5KI/Hsv8QfsxmBLmSmQCNd5BgmHuxO/9TYmljYOn4Ham5/WMd3evBNeN6pcHzP
+XKDZhbFBsi8v+cYCEieoiFsUxLJDpEalYw0dJscqjzRxbyDc6RyMHQwrwPiW/vtd
+jw59c/STHgsUbtpPa6APuyOM
+=k616
+-----END PGP SIGNATURE-----

expat.changes

@@ -1,3 +1,41 @@
+-------------------------------------------------------------------
+Tue Feb  3 08:17:21 UTC 2026 - Petr Gajdos <pgajdos@suse.com>
+
+- version update to 2.7.4
+  * CVE-2026-24515 -- Function XML_ExternalEntityParserCreate
+            failed to copy the encoding handler data passed to
+            XML_SetUnknownEncodingHandler from the parent to the new
+            subparser. This can cause a NULL dereference (CWE-476) from
+            external entities that declare use of an unknown encoding.
+            The expected impact is denial of service. It takes use of
+            both functions XML_ExternalEntityParserCreate and
+            XML_SetUnknownEncodingHandler for an application to be
+            vulnerable.
+  * CVE-2026-25210 -- Add missing check for integer overflow
+            related to buffer size determination in function doContent
+  * lib: Fix missing undoing of group size expansion in doProlog
+            failure cases
+  * xmlwf: Fix a memory leak
+  * WASI: Fix format specifiers for 32bit WASI SDK
+- fixes [bsc#1257144] and [bsc#1257496]
+- obsolete CVE-2025-59375.patch
+
+-------------------------------------------------------------------
+Sat Sep 27 09:21:33 UTC 2025 - Christoph G <foss@grueninger.de>
+
+- version update to 2.7.3
+  * Fix alignment of internal allocations for some non-amd64
+    architectures (e.g. sparc32); fixes up on the fix to
+    CVE-2025-59375 (of Expat 2.7.2)
+  * Fix a class of false positives where input should have been
+    rejected with error XML_ERROR_ASYNC_ENTITY; regression from
+    CVE-2024-8176 (of Expat 2.7.0)
+  * Prove and regression-proof absence of integer overflow
+    from function expat_realloc
+  * Remove "harmless" cast that truncated a size_t to unsigned
+  * xmlwf: Resolve use of functions XML_GetErrorLineNumber
+    and XML_GetErrorColumnNumber
+
 -------------------------------------------------------------------
 Mon Sep 22 14:54:27 UTC 2025 - pgajdos@suse.com
 

expat.spec

@@ -17,10 +17,10 @@
 #
 
 
-%global unversion 2_7_2
+%global unversion 2_7_4
 %define sover 1
 Name:           expat
-Version:        2.7.2
+Version:        2.7.4
 Release:        0
 Summary:        XML Parser Toolkit
 License:        MIT