Libexpat Project Libexpat vulnerabilities, page 2
65 vulnerabilities
Known vulnerabilities in Libexpat Project Libexpat, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2022-22825alpineexpat+23
EPSS score2.79%
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22822alpineexpat+23EPSS score5.10%
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22823alpineexpat+23EPSS score3.60%
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-23990alpineexpat+18EPSS score4.69%
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.CVE-2022-23852alpineexpat+28EPSS score5.08%
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.CVE-2012-1148applemac_os_x+15EPSS score3.56%
Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.CVE-2012-1147applemac_os_x+10EPSS score2.57%
readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor consumption) via a large number of crafted XML files.CVE-2012-0876canonicalubuntu_linux+23EPSS score5.72%
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.CVE-2012-6702alpineexpat+12EPSS score2.37%
Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.CVE-2017-11742libexpat_projectlibexpatEPSS score0.46%
The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory because of an untrusted search path, aka DLL hijacking.CVE-2017-9233alpineexpat+13EPSS score8.74%
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.CVE-2024-45492alpineexpat+20EPSS score1.39%
An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).CVE-2024-45491alpineexpat+30EPSS score1.13%
An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).CVE-2024-45490alpineexpat+21EPSS score1.69%
An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.CVE-2024-28757alpineexpat+39EPSS score2.01%
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).CVE-2024-50602alpineexpat+77EPSS score1.12%
An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.CVE-2009-3560apachehttp_server+24EPSS score24.31%
The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.CVE-2009-3720apachehttp_server+31EPSS score27.92%
The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.CVE-2019-15903alpineexpat+35EPSS score6.64%
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.CVE-2026-41080alpineexpat+23EPSS score0.40%
libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.