CVE-2006-10002
Fixed in a distro release EPSS <1%CVSS 9.8
XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes. A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.
Products: TODDR XML::Parser
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | perl-XML-Parser | 2.47-6.1.el10_1 |
| AlmaLinux 8 | perl-XML-Parser | 2.44-12.el8_10 |
| AlmaLinux 9 | perl-XML-Parser | 2.46-9.1.el9_7 |
| Amazon Linux 2 | perl-XML-Parser | 2.41-10.amzn2.0.3 |
| Amazon Linux 2023 | perl-XML-Parser | 2.51-1.amzn2023.0.1 |
| Amazon Linux 2023 | perl-XML-Parser-tests | 2.51-1.amzn2023.0.1 |
| Debian 12 | libxml-parser-perl | 2.46-1 |
| Debian 13 | libxml-parser-perl | 2.46-1 |
| Debian 14 | libxml-parser-perl | 2.46-1 |
| Red Hat Enterprise Linux 10.1 | perl-XML-Parser | 0:2.47-6.1.el10_1 |
| Red Hat Enterprise Linux 10.1 | perl-XML-Parser-debuginfo | 0:2.47-6.1.el10_1 |
| Red Hat Enterprise Linux 10.1 | perl-XML-Parser-debugsource | 0:2.47-6.1.el10_1 |
| Red Hat Enterprise Linux 8 | perl-XML-Parser | 0:2.44-12.el8_10 |
| Red Hat Enterprise Linux 8 | perl-XML-Parser-debuginfo | 0:2.44-12.el8_10 |
| Red Hat Enterprise Linux 8 | perl-XML-Parser-debugsource | 0:2.44-12.el8_10 |
| Red Hat Enterprise Linux 9 | perl-XML-Parser | 0:2.46-9.1.el9_7 |
| Red Hat Enterprise Linux 9 | perl-XML-Parser-debuginfo | 0:2.46-9.1.el9_7 |
| Red Hat Enterprise Linux 9 | perl-XML-Parser-debugsource | 0:2.46-9.1.el9_7 |
| Red Hat Enterprise Linux eus 10.0 | perl-XML-Parser | 0:2.47-6.el10_0.1 |
| Red Hat Enterprise Linux eus 10.0 | perl-XML-Parser-debuginfo | 0:2.47-6.el10_0.1 |
| Red Hat Enterprise Linux eus 10.0 | perl-XML-Parser-debugsource | 0:2.47-6.el10_0.1 |
| Red Hat rhel aus 8.2 | perl-XML-Parser | 0:2.44-11.el8_2.1 |
| Red Hat rhel aus 8.2 | perl-XML-Parser-debuginfo | 0:2.44-11.el8_2.1 |
| Red Hat rhel aus 8.2 | perl-XML-Parser-debugsource | 0:2.44-11.el8_2.1 |
| Red Hat rhel aus 8.4 | perl-XML-Parser | 0:2.44-11.el8_4.1 |
| Red Hat rhel aus 8.4 | perl-XML-Parser-debuginfo | 0:2.44-11.el8_4.1 |
| Red Hat rhel aus 8.4 | perl-XML-Parser-debugsource | 0:2.44-11.el8_4.1 |
| Red Hat rhel aus 8.6 | perl-XML-Parser | 0:2.44-11.el8_6.1 |
| Red Hat rhel aus 8.6 | perl-XML-Parser-debuginfo | 0:2.44-11.el8_6.1 |
| Red Hat rhel aus 8.6 | perl-XML-Parser-debugsource | 0:2.44-11.el8_6.1 |
| Red Hat rhel e4s 8.6 | perl-XML-Parser | 0:2.44-11.el8_6.1 |
| Red Hat rhel e4s 8.6 | perl-XML-Parser-debuginfo | 0:2.44-11.el8_6.1 |
| Red Hat rhel e4s 8.6 | perl-XML-Parser-debugsource | 0:2.44-11.el8_6.1 |
| Red Hat rhel e4s 8.8 | perl-XML-Parser | 0:2.44-11.el8_8.1 |
| Red Hat rhel e4s 8.8 | perl-XML-Parser-debuginfo | 0:2.44-11.el8_8.1 |
| Red Hat rhel e4s 8.8 | perl-XML-Parser-debugsource | 0:2.44-11.el8_8.1 |
| Red Hat rhel e4s 9.0 | perl-XML-Parser | 0:2.46-9.el9_0.1 |
| Red Hat rhel e4s 9.0 | perl-XML-Parser-debuginfo | 0:2.46-9.el9_0.1 |
| Red Hat rhel e4s 9.0 | perl-XML-Parser-debugsource | 0:2.46-9.el9_0.1 |
| Red Hat rhel e4s 9.2 | perl-XML-Parser | 0:2.46-9.el9_2.1 |
| Red Hat rhel e4s 9.2 | perl-XML-Parser-debuginfo | 0:2.46-9.el9_2.1 |
| Red Hat rhel e4s 9.2 | perl-XML-Parser-debugsource | 0:2.46-9.el9_2.1 |
| Red Hat rhel els 7 | perl-XML-Parser | 0:2.41-10.el7_9.1 |
| Red Hat rhel els 7 | perl-XML-Parser-debuginfo | 0:2.41-10.el7_9.1 |
| Red Hat rhel eus 9.4 | perl-XML-Parser | 0:2.46-9.el9_4.1 |
| Red Hat rhel eus 9.4 | perl-XML-Parser-debuginfo | 0:2.46-9.el9_4.1 |
| Red Hat rhel eus 9.4 | perl-XML-Parser-debugsource | 0:2.46-9.el9_4.1 |
| Red Hat rhel eus 9.6 | perl-XML-Parser | 0:2.46-9.el9_6.1 |
| Red Hat rhel eus 9.6 | perl-XML-Parser-debuginfo | 0:2.46-9.el9_6.1 |
| Red Hat rhel eus 9.6 | perl-XML-Parser-debugsource | 0:2.46-9.el9_6.1 |
| Red Hat rhel eus long life 8.4 | perl-XML-Parser | 0:2.44-11.el8_4.1 |
| Red Hat rhel eus long life 8.4 | perl-XML-Parser-debuginfo | 0:2.44-11.el8_4.1 |
| Red Hat rhel eus long life 8.4 | perl-XML-Parser-debugsource | 0:2.44-11.el8_4.1 |
| Red Hat rhel tus 8.6 | perl-XML-Parser | 0:2.44-11.el8_6.1 |
| Red Hat rhel tus 8.6 | perl-XML-Parser-debuginfo | 0:2.44-11.el8_6.1 |
| Red Hat rhel tus 8.6 | perl-XML-Parser-debugsource | 0:2.44-11.el8_6.1 |
| Red Hat rhel tus 8.8 | perl-XML-Parser | 0:2.44-11.el8_8.1 |
| Red Hat rhel tus 8.8 | perl-XML-Parser-debuginfo | 0:2.44-11.el8_8.1 |
| Red Hat rhel tus 8.8 | perl-XML-Parser-debugsource | 0:2.44-11.el8_8.1 |
| Rocky Linux 10 | perl-XML-Parser | 0:2.47-6.1.el10_1 |
| Rocky Linux 8 | perl-XML-Parser | 0:2.44-12.el8_10 |
| Rocky Linux 9 | perl-XML-Parser | 0:2.46-9.1.el9_7 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | perl-XML-Parser | 2.44-150000.3.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | perl-XML-Parser | 2.44-150000.3.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | perl-XML-Parser | 2.44-150000.3.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | perl-XML-Parser | 2.44-150000.3.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | perl-XML-Parser | 2.44-150000.3.3.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | perl-XML-Parser | 2.41-23.3.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | perl-XML-Parser | 2.44-150000.3.3.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | perl-XML-Parser | 2.44-150000.3.3.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | perl-XML-Parser | 2.44-150000.3.3.1 |
| SUSE Linux Enterprise Server 16.0 | perl-XML-Parser | 2.470.0-160000.3.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | perl-XML-Parser | 2.41-23.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | perl-XML-Parser | 2.44-150000.3.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | perl-XML-Parser | 2.44-150000.3.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | perl-XML-Parser | 2.44-150000.3.3.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | perl-XML-Parser | 2.470.0-160000.3.1 |
| Ubuntu 16.04 LTS | libxml-parser-perl | no fix |
| Ubuntu 18.04 LTS | libxml-parser-perl | no fix |
| Ubuntu 20.04 LTS | libxml-parser-perl | no fix |
| Ubuntu 22.04 LTS | libxml-parser-perl | 2.46-3ubuntu0.1 |
| Ubuntu 24.04 LTS | libxml-parser-perl | 2.47-1ubuntu0.24.04.1 |
| Ubuntu 25.10 | libxml-parser-perl | 2.47-1ubuntu0.25.10.1 |
| openSUSE Leap 15.6 | perl-XML-Parser | 2.44-150000.3.3.1 |
| openSUSE Leap 16.0 | perl-XML-Parser | 2.470.0-160000.3.1 |
| openSUSE Tumbleweed | perl-XML-Parser | 2.570.0-1.1 |