29 results · Feed
-
High 7.5
libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nes…
-
Medium 5.9
libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail…
-
Medium 4.9
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking…
-
Medium 6.9
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
-
Medium 6.9
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
-
Medium 6.5
xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in copyString.
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Pars…
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in getAttributeId.
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in addBinding.
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in storeAtts.
-
Medium 6.9
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing arra…
-
Medium 4.9
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of …
-
Medium 4.9
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_Par…
-
Low 2.9
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service vi…
-
Low 2.9
libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
-
Low 2.9
libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-mem…
-
Medium 4.0
libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
-
Medium 4.0
libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
-
Medium 6.9
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is n…
-
Low 2.9
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
-
High 7.5
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that i…
-
High 7.5CVE-2024-8176 Public exploit
Libexpat: expat: improper restriction of xml entity expansion depth in libexpat
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting …
-
Medium 5.9CVE-2024-50602 Public exploit
An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_Sto…
-
High 7.3
An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_gro…
-
Critical 9.8CVE-2024-45490 Public exploit
An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.
-
High 7.3
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts o…
-
High 7.5CVE-2024-28757 Public exploit
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created vi…