SUSE-CU-2025:6895-1: Security update of suse/pcp

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/pcp
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2025:6895-1
Container Tags        : suse/pcp:6 , suse/pcp:6.2 , suse/pcp:6.2.0 , suse/pcp:6.2.0-62.38 , suse/pcp:latest
Container Release     : 62.38
Severity              : important
Type                  : security
References            : 1239618 CVE-2024-8176 
-----------------------------------------------------------------

The container suse/pcp was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:3239-1
Released:    Tue Sep 16 19:04:00 2025
Summary:     Security update for expat
Type:        security
Severity:    important
References:  1239618,CVE-2024-8176
This update for expat fixes the following issues:

expat was updated to version 2.7.1:

  -  Bug fixes:

       - Restore event pointer behavior from Expat 2.6.4
        (that the fix to CVE-2024-8176 changed in 2.7.0);
        affected API functions are:

                    - XML_GetCurrentByteCount
                    - XML_GetCurrentByteIndex
                    - XML_GetCurrentColumnNumber
                    - XML_GetCurrentLineNumber
                    - XML_GetInputContext
  -  Other changes:

       - Fix printf format specifiers for 32bit Emscripten
       - docs: Promote OpenSSF Best Practices self-certification
       - tests/benchmark: Resolve mistaken double close
       - Address compiler warnings
       - Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
         to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
         for what these numbers do

Version update to 2.7.0 (CVE-2024-8176, bsc#1239618, jsc#PED-12507)

* Security fixes:

- CVE-2024-8176 -- Fix crash from chaining a large number of
  entities caused by stack overflow by resolving use of recursion,
  for all three uses of entities: - general entities in character data
  ('<e>&g1;</e>') - general entities in attribute values
  ('<e k1='&g1;'/>') - parameter entities ('%p1;')

  Known impact is (reliable and easy) denial of service:
  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
  (Base Score: 7.5, Temporal Score: 7.2)
  Please note that a layer of compression around XML can
  significantly reduce the minimum attack payload size.

* Other changes:
  - docs: Add missing documentation of error code XML_ERROR_NOT_STARTED
    that was introduced with 2.6.4
  - docs: Document need for C++11 compiler for use from C++
  - Address Cppcheck warnings
  - Mass-migrate links from http:// to https://

  - Document changes since the previous release
  - Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
    for what these numbers do


The following package changes have been done:

- libexpat1-2.7.1-150700.3.3.1 updated
- container:bci-bci-init-15.7-4c92fbeff708bd7a0d0ae84851bca2a17279a699f93b0ddd1ef1566de065fe9d-0 updated