PT-2025-46012 · Julia · Expat Jll

Publicado 2025-10-14 · Atualizado 2025-10-14

OSV

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML GetCurrentLineNumber (or XML GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

Identificadores relacionados

JLSEC-2025-41

Produtos afetados

Expat Jll

Referências · 60

• https://github.com/libexpat/libexpat/issues/317 · Nota
• https://github.com/libexpat/libexpat/issues/342 · Nota
• https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43 · Nota
• https://github.com/libexpat/libexpat/pull/318 · Nota
• https://security.netapp.com/advisory/ntap-20190926-0004 · Nota
• https://access.redhat.com/errata/RHSA-2019:3756 · Nota
• https://tenable.com/security/tns-2021-11 · Nota
• http://seclists.org/fulldisclosure/2019/Dec/23 · Nota
• https://seclists.org/bugtraq/2019/Dec/21 · Nota
• https://osv.dev/vulnerability/JLSEC-2025-41 · Aviso do Fabricante
• https://seclists.org/bugtraq/2019/Sep/30 · Nota
• https://usn.ubuntu.com/4165-1 · Nota
• https://oracle.com/security-alerts/cpuapr2020.html · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html · Nota
• https://debian.org/security/2019/dsa-4571 · Aviso do Fabricante