GCVE - cpe:2.3:a:toddr:xml::parser:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:toddr:xml::parser:*:*:*:*:*:*:*:*

part: a version: * update: parser

Vendor	Toddr (`7c03a380-f4ad-5ecb-817e-23f3dbeb385c`)
Product	Xml (`7814a6fb-7123-5c2e-aea6-43e73af8e20c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2006-10003`	vulnerable	2026-06-08 04:48:55.936518	XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting Published: 2026-03-19T11:08:04.341Z Updated: 2026-07-15T01:28:08.168Z Open on db.gcve.eu Reference links https://rt.cpan.org/Ticket/Display.html?id=19860 https://github.com/cpan-authors/XML-Parser/issues/39 https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-10002`	vulnerable	2026-06-08 04:48:55.935413	XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes. A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes. Published: 2026-03-19T11:03:46.888Z Updated: 2026-04-29T14:36:41.837Z Open on db.gcve.eu Reference links https://rt.cpan.org/Ticket/Display.html?id=19859 https://github.com/cpan-authors/XML-Parser/issues/64 https://metacpan.org/release/TODDR/XML-Parser-2.46/changes https://github.com/cpan-authors/XML-Parser/commit/56b0509dfc6b559cd7555ea81ee62e3622069255.patch	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.