网安资讯详情 - SecLens 情报雷达

网安资讯，一网打尽。汇集权威漏洞通告与行业要闻，结合分组浏览、智能过滤、RSS订阅 和 Webhook 推送，多通道拓展您的安全情报视野。

ALINUX4-SA-2026:0311

来源： alibaba_cloud_linux_advisory · 发布时间 2026-07-23 16:07 (UTC+08:00) · 抓取时间 2026-07-23 20:00 (UTC+08:00)

原文链接

摘要

Package updates are available for Alibaba Cloud Linux 4 that fix the following vulnerabilities: CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). CVE-2026-56406: libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. **Solution**: 请您尽快将升级到修复后的版本。修复命令如下： yum update --advisory ALINUX4-SA-2026:0311 **Affected Products**: Alinux 4

正文

Package updates are available for Alibaba Cloud Linux 4 that fix the following vulnerabilities: CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). CVE-2026-56406: libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.

标签

扩展字段

{
  "advisory_id": "ALINUX4-SA-2026:0311",
  "affected_products": [
    "Alinux 4"
  ],
  "cve_ids": [
    "CVE-2026-50219",
    "CVE-2026-56131",
    "CVE-2026-56406"
  ],
  "raw_pub_date": "Thu, 23 Jul 2026 16:07:13 +0800",
  "solution": "请您尽快将升级到修复后的版本。修复命令如下：\nyum update --advisory ALINUX4-SA-2026:0311"
}