Suggested advisory:
========================

The updated packages fix a security vulnerability:

Improper restriction of xml entity expansion depth in libexpat. (CVE-2024-8176)

References:
https://www.openwall.com/lists/oss-security/2025/03/14/5
========================

Updated packages in core/updates_testing:
========================
expat-2.7.0-1.mga9
lib(64)expat1-2.7.0-1.mga9
lib(64)expat-devel-2.7.0-1.mga9

from SRPM:
expat-2.7.0-1.mga9.src.rpm

Assignee: nicolas.salguero => qa-bugs
Status: NEW => ASSIGNED

RH x86_64

python3 payload1.py | xmlwf    -r /dev/stdin

Violación de segmento (`core' generado)


installing lib64expat1-2.7.0-1.mga9.x86_64.rpm expat-2.7.0-1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/2: lib64expat1           ##################################################################################################
      2/2: expat                 ##################################################################################################
      1/2: removing expat-2.6.4-1.mga9.x86_64
                                 ##################################################################################################
      2/2: removing lib64expat1-2.6.4-1.mga9.x86_64
                                 ##################################################################################################

python3 payload1.py | xmlwf    -r /dev/stdin
Not produce output

python3 payload1.py 2
<!DOCTYPE doc [
  <!ENTITY e0 ''>
  <!ENTITY e1 '&e0;'>
  <!ENTITY e2 '&e1;'>
]>
<doc>&e2;</doc>

OK I think

See https://github.com/libexpat/libexpat/issues/893

Followed the procedure from the wiki, as was used in bug#31057 comment#2 (needed test files are attached to bug#31057)

python testexpat.py 
Tested OK

xmlwf /etc/xml/catalog
xmlwf /etc/passwd
/etc/passwd:1:16: not well-formed (invalid token)

Looks good

MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues.
Followed tests as above with files from bug 31057:
$ python testexpat.py
Tested OK
$ python3 testexpat.py
Tested OK
$ xmlwf /etc/xml/catalog
$ xmlwf /etc/passwd
/etc/passwd:1:16: not well-formed (invalid token)
Good to go.

Whiteboard: (none) => MGA9-64-OK
CC: (none) => herman.viaene

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0109.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED