Description

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

Remediation

References

CVE-2019-15903

Related Vulnerabilities

WordPress Plugin WPS Bidouille Multiple Vulnerabilities (1.12.2)

MongoDb Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2026-13069)

OpenSSL Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2023-5678)

Varnish Cache Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2013-4484)

Internet Information Services Improper Input Validation Vulnerability (CVE-2009-4445)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities CWE-125 CVE-2019-15903