Most recent entries from all

ALSA-2026:7679 — Important: perl-XML-Parser security update

Affected: AlmaLinux:9: perl-XML-Parser

This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.

Security Fix(es):

* perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003) * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-12814

BREW-perl-xml-parser-CVE-2006-10003 — XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (sta…

Affected: Homebrew: perl-xml-parser

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting

certfr-2026-avi-0667 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-0667

EUVD-2026-337763

fkie_cve-2006-10003

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.

In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.

The bug can be observed when parsing an XML file with very deep element nesting

GHSA-x2wr-f89p-cqwh

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.

The bug can be observed when parsing an XML file with very deep element nesting

msrc_CVE-2006-10003 — XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack

msrc_CVE-2006-10003

openSUSE-SU-2026:10527-1 — perl-XML-Parser-2.570.0-1.1 on GA media

perl-XML-Parser-2.570.0-1.1 on GA media

RHSA-2026:8577 — Red Hat Security Advisory: perl-XML-Parser security update

perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files

SUSE-SU-2026:1152-1 — Security update for perl-XML-Parser

Security update for perl-XML-Parser

UBUNTU-CVE-2006-10003

Affected: Ubuntu:16.04:LTS: libxml-parser-perl, Ubuntu:18.04:LTS: libxml-parser-perl, Ubuntu:20.04:LTS: libxml-parser-perl, Ubuntu:22.04:LTS: libxml-parser-perl, Ubuntu:24.04:LTS: libxml-parser-perl, Ubuntu:25.10: libxml-parser-perl

WID-SEC-W-2026-1055 — Red Hat Enterprise Linux (perl-xml-parser): Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen oder eine Speicherbeschädigung zu verursachen.