Description
libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
libexpat libexpat
Default version status: unaffected
2.7.2 to ≤ 2.8.5affected
References
- https://github.com/libexpat/libexpat/pull/1392 ↗
- https://github.com/libexpat/libexpat/commit/209801d7fbaf07ab74bae8cb32dd2ab9e5846118 ↗
- https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/lib/xmlparse.c#L1003 ↗
- https://github.com/libexpat/libexpat ↗
- https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.8.5-integer-overflow-in-expat-realloc ↗