61 results · Feed
-
High 7.3
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts o…
-
High 7.5CVE-2024-28757 Public exploit
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created vi…
-
Medium 5.5
libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
-
High 7.5
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in t…
-
High 7.5CVE-2022-43680 Public exploit
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEnt…
-
High 8.1
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
-
High 7.5CVE-2022-25314 Public exploit
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
-
Critical 9.8CVE-2022-25315 Public exploit
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
-
Medium 6.5CVE-2022-25313 Public exploit
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth…
-
Critical 9.8CVE-2022-25235 Public exploit
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…
-
High 7.5CVE-2022-23990 Public exploit
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
-
Critical 9.8CVE-2022-23852 Public exploit
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML…
-
Critical 9.8CVE-2022-22822 Public exploit
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
Critical 9.8
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.8
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
-
High 8.1CVE-2021-46143 Public exploit
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
-
High 8.8CVE-2021-45960 Public exploit
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can l…
-
Medium 6.5
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing to…