Fluid Attacks Database

Description

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	expat	>=0 <2.4.3-1	2.4.3-1
alpine v3.22	expat	>=0 <2.4.3-r0	2.4.3-r0
alpine v3.17	expat	>=0 <2.4.3-r0	2.4.3-r0
alpine v3.19	expat	>=0 <2.4.3-r0	2.4.3-r0
debian 12	libxmltok	=1.2-4 \|\| =1.2-4.1 \|\| =1.2-4.1~exp1 \|\| =1.2-4.2	-
alpine v3.13	expat	>=0 <2.2.10-r2	2.2.10-r2
alpine v3.14	expat	>=0 <2.4.3-r0	2.4.3-r0
alpine v3.15	expat	>=0 <2.4.3-r0	2.4.3-r0
alpine v3.16	expat	>=0 <2.4.3-r0	2.4.3-r0
alpine v3.18	expat	>=0 <2.4.3-r0	2.4.3-r0

1-10 of 34

Aliases

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.