expat - security update

Two related issues have been discovered in Expat, a C library for parsing
XML.

• CVE-2012-6702
  It was introduced when
  CVE-2012-0876
  was addressed. Stefan Sørensen discovered that the use of the function
  XML_Parse() seeds the random number generator generating repeated outputs
  for rand() calls.
• CVE-2016-5300
  It is the product of an incomplete solution for
  CVE-2012-0876.
  The parser poorly seeds the random number generator allowing an attacker to
  cause a denial of service (CPU consumption) via an XML file with crafted
  identifiers.

You might need to manually restart programs and services using expat
libraries.

For the stable distribution (jessie), these problems have been fixed in
version 2.1.0-6+deb8u3.

For the unstable distribution (sid), these problems have been fixed in
version 2.1.1-3.

We recommend that you upgrade your expat packages.