The updatePosition function in lib/xmltok_impl.c in...
Moderate severity
Unreviewed
Published
May 2, 2022
to the GitHub Advisory Database
•
Updated Feb 24, 2024
Description
Published by the National Vulnerability Database
Nov 3, 2009
Published to the GitHub Advisory Database
May 2, 2022
Last updated
Feb 24, 2024
The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.
References