Fluid Attacks Database

Description

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	expat	=2.5.0-1 \|\| =2.5.0-1+deb12u1 \|\| =2.5.0-1+deb12u2 \|\| =2.5.0-1+deb12u3 \|\| >=0 <2.5.0-1+deb12u4	2.5.0-1+deb12u4
rpm rhel10	expat	-	-
rpm rhel6	expat	-	-
rpm rhel9	expat	-	-
rpm rhel8	mingw-expat	-	-
debian 13	expat	=2.7.1-2 \|\| =2.7.2-1 \|\| =2.7.3-1 \|\| =2.7.3-2 \|\| =2.7.4-1 \|\| =2.7.5-1 \|\| =2.8.0-1 \|\| =2.8.0-2 \|\| =2.8.1-1 \|\| >=0 <2.8.2-1~deb13u1	2.8.2-1~deb13u1
debian 14	expat	=2.7.1-2 \|\| =2.7.2-1 \|\| =2.7.3-1 \|\| >=0 <2.7.3-2	2.7.3-2
alpine v3.20	expat	>=0 <2.7.4-r0	2.7.4-r0
alpine v3.21	expat	>=0 <2.7.4-r0	2.7.4-r0
alpine v3.22	expat	>=0 <2.7.4-r0	2.7.4-r0

1-10 of 15

Aliases

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.