Fluid Attacks Database

Description

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	libxmltok	=1.2-4 \|\| =1.2-4.1 \|\| =1.2-4.1~exp1 \|\| =1.2-4.2	-
alpine v3.22	expat	>=0 <2.4.9-r0	2.4.9-r0
alpine v3.13	expat	>=0 <2.2.10-r7	2.2.10-r7
alpine v3.16	expat	>=0 <2.4.9-r0	2.4.9-r0
alpine v3.18	expat	>=0 <2.4.9-r0	2.4.9-r0
alpine v3.19	expat	>=0 <2.4.9-r0	2.4.9-r0
alpine v3.20	expat	>=0 <2.4.9-r0	2.4.9-r0
debian 14	expat	>=0 <2.4.8-2	2.4.8-2
debian 11	libxmltok	=1.2-4 \|\| =1.2-4.1 \|\| =1.2-4.1~exp1 \|\| =1.2-4.2	-
alpine v3.14	expat	>=0 <2.4.9-r0	2.4.9-r0

1-10 of 36

Aliases

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.