QSN-8813-1: Expat vulnerabilities
2026-09-24

Summary:
Expat could be made to crash or run programs if it received specially
crafted input.

Details:
It was discovered that Expat did not correctly handle certain integer
arithmetic. An attacker could possibly use this issue to cause a denial of
service. 
(CVE-2026-56406, CVE-2026-56407, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411)

It was discovered that Expat did not correctly track handler call depth. An
attacker could possibly use this issue to cause Expat to crash or execute
arbitrary code. (CVE-2026-56131)

It was discovered that Expat did not correctly handle certain memory
operations. An attacker could possibly use this issue to cause Expat to
crash or execute arbitrary code. (CVE-2026-56132)

It was discovered that Expat did not correctly handle certain Unicode
characters. An attacker could possibly use this issue to cause Expat to use
excessive resources, leading to a denial of service. (CVE-2026-72522)

It was discovered that Expat did not correctly process certain XML
attributes. A remote attacker could possibly use this issue to cause Expat
to use excessive resources, leading to a denial of service.
(CVE-2026-66046)

It was discovered that Expat did not correctly handle certain external
entities. An attacker could possibly use this issue to cause Expat to crash
or execute arbitrary code. (CVE-2026-76641)

It was discovered that Expat did not correctly track handler call depth
with custom encodings. An attacker could possibly use this issue to cause
Expat to crash or execute arbitrary code. (CVE-2026-76957)

Affected QuantaStor releases:
  6.9.1.001 jammy: libexpat1 2.4.7-1ubuntu0.9 (fixed in 2.4.7-1ubuntu0.9)
  6.9.1.001 jammy: libexpat1-dev 2.4.7-1ubuntu0.9 (fixed in 2.4.7-1ubuntu0.9)
  6.9.0.464 jammy: libexpat1 2.4.7-1ubuntu0.9 (fixed in 2.4.7-1ubuntu0.9)
  6.9.0.464 jammy: libexpat1-dev 2.4.7-1ubuntu0.9 (fixed in 2.4.7-1ubuntu0.9)
  6.8.6.015 jammy: libexpat1 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)
  6.8.6.015 jammy: libexpat1-dev 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)
  6.8.5.018 jammy: libexpat1 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)
  6.8.5.018 jammy: libexpat1-dev 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)
  6.8.4.038 jammy: libexpat1 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)
  6.8.4.038 jammy: libexpat1-dev 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)
  6.8.3.018 jammy: libexpat1 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)
  6.8.3.018 jammy: libexpat1-dev 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)
  6.8.2.002 jammy: libexpat1 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)
  6.8.2.002 jammy: libexpat1-dev 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)
  6.8.1.007 jammy: libexpat1 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)
  6.8.1.007 jammy: libexpat1-dev 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)
  6.8.0.205 jammy: libexpat1 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)
  6.8.0.205 jammy: libexpat1-dev 2.4.7-1ubuntu0.7 (fixed in 2.4.7-1ubuntu0.9)

CVEs: CVE-2026-56410, CVE-2026-66046, CVE-2026-56406, CVE-2026-56132, CVE-2026-56407, CVE-2026-56411, CVE-2026-72522, CVE-2026-76957, CVE-2026-76641, CVE-2026-56131, CVE-2026-56409

References:
  https://ubuntu.com/security/notices/USN-8813-1