Total 56 security vulnerabilities recorded for libexpat_project software and firmware.
An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer....
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreat...
libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time....
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for wh...
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memor...
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c....
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames....
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString....
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element....
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs....
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a ce...
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function....
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES....
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow....
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow....
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow....
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow....
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow....
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow....
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize....
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g...
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to ...
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount...
The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a T...