Fluid Attacks Database

Description

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.20	expat	>=0 <2.4.4-r0	2.4.4-r0
debian 12	expat	>=0 <2.4.3-2	2.4.3-2
alpine v3.12	expat	>=0 <2.2.10-r1	2.2.10-r1
alpine v3.14	expat	>=0 <2.4.4-r0	2.4.4-r0
alpine v3.15	expat	>=0 <2.4.4-r0	2.4.4-r0
alpine v3.16	expat	>=0 <2.4.4-r0	2.4.4-r0
alpine v3.18	expat	>=0 <2.4.4-r0	2.4.4-r0
debian 13	expat	>=0 <2.4.3-2	2.4.3-2
debian 14	expat	>=0 <2.4.3-2	2.4.3-2
debian 11	libxmltok	=1.2-4 \|\| =1.2-4.1 \|\| =1.2-4.1~exp1 \|\| =1.2-4.2	-

1-10 of 28

Aliases

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.