{"id":"CVE-2006-10002","aliases":["ALSA-2026:7679","ALSA-2026:7680","ALSA-2026:7681","DEBIAN-CVE-2006-10002","EUVD-2006-7232","GHSA-h943-hrx6-86cq","MGASA-2026-0063","RHSA-2026:7679","RHSA-2026:7680","RHSA-2026:7681","RHSA-2026:8577","RHSA-2026:8578","RHSA-2026:8608","RHSA-2026:8609","RHSA-2026:8610","RHSA-2026:9110","RHSA-2026:9246","RHSA-2026:9258","RHSA-2026:9259","RHSA-2026:9605","RLSA-2026:7679","RLSA-2026:7680","RLSA-2026:7681","SUSE-SU-2026:1152-1","SUSE-SU-2026:1153-1","SUSE-SU-2026:20993-1","UBUNTU-CVE-2006-10002","USN-8174-1","openSUSE-SU-2026:10527-1","openSUSE-SU-2026:20459-1"],"status":"published","title":"XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes","description":"XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes.\n\nA :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00628,"percentile":0.50366,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-176"],"published":"2026-03-19T11:03:46Z","modified":"2026-10-29T11:58:18Z","fixes":[{"ecosystem":"Debian:12","package":"libxml-parser-perl","fixed_in":["2.46-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml-parser-perl","fixed_in":["2.46-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml-parser-perl","fixed_in":["2.46-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libxml-parser-perl","fixed_in":["2.46-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libxml-parser-perl","fixed_in":["2.47-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libxml-parser-perl","fixed_in":["2.47-1ubuntu0.25.10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46-9.1.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-6.1.el10_1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-12.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.460.0-6.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.1.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.1.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.1.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.1.el10_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.1.el10_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.1.el10_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-12.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-12.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-12.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.41-10.el7_9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.41-10.el7_9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.el10_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.el10_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.el10_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.1.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.1.el10_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-12.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41-23.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41-23.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.470.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.470.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-3","2.44-1","2.44-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.44-2build3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.44-4","2.44-4build1","2.46-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46-3ubuntu0.1"}]}],"versions":["2.46-2","2.46-2build1","2.46-3","2.46-3build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-1ubuntu0.24.04.1"}]}],"versions":["2.46-4","2.47-1","2.47-1build1","2.47-1build2","2.47-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-1ubuntu0.25.10.1"}]}],"versions":["2.47-1build4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46-3ubuntu0.1"}]}],"versions":["2.46-2","2.46-2build1","2.46-3","2.46-3build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-1ubuntu0.24.04.1"}]}],"versions":["2.46-4","2.47-1","2.47-1build1","2.47-1build2","2.47-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-1ubuntu0.25.10.1"}]}],"versions":["2.47-1build4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.570.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.470.0-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"toddr","product":"xml::parser"},{"vendor":"toddr","product":"xml\\"}],"references":[{"url":"https://rt.cpan.org/Ticket/Display.html?id=19859","tags":["issue-tracking","Mailing List","article"]},{"url":"https://github.com/cpan-authors/XML-Parser/issues/64","tags":["issue-tracking","Issue Tracking","article"]},{"url":"https://metacpan.org/release/TODDR/XML-Parser-2.46/changes","tags":["release-notes"]},{"url":"https://github.com/cpan-authors/XML-Parser/commit/56b0509dfc6b559cd7555ea81ee62e3622069255.patch","tags":["patch"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/19/1","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/22/3"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-10002","tags":["advisory"]},{"url":"https://github.com/cpan-authors/XML-Parser/commit/6b291f4d260fc124a6ec80382b87a918f372bc6b.patch","tags":["article"]},{"url":"https://github.com/advisories/GHSA-h943-hrx6-86cq"},{"url":"https://access.redhat.com/errata/RHSA-2026:7679","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-10002","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2006-10003","tags":["report"]},{"url":"https://bugzilla.redhat.com/2448999","tags":["report"]},{"url":"https://bugzilla.redhat.com/2449001","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-7679.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7680","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-7680.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7681","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-7681.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2006-10002","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0063.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35238","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/03/19/1","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/03/19/2","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448999","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449001","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7679.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-10002","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-10003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-10003","tags":["advisory"]},{"url":"https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch","tags":["article"]},{"url":"https://github.com/cpan-authors/XML-Parser/issues/39","tags":["article"]},{"url":"https://rt.cpan.org/Ticket/Display.html?id=19860","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7680.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7681.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8577","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8577.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8578","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8578.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8608","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8608.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8609","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8609.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8610","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8610.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9110","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9110.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9246","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9246.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9258","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9258.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9259","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9259.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9605","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9605.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7679","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7680","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7681","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261152-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259901","tags":["report"]},{"url":"https://bugzilla.suse.com/1259902","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2006-10002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-10003","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261153-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620993-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2006-10002","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/38106361/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8174-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2006-10003","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2006-10002","title":"XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes","description":"XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes.\n\nA :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.","status":"published","published":"2026-03-19T11:03:46.888Z","modified":"2026-04-29T14:36:41.837Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-122","CWE-176"],"updated_at":"2026-11-02T14:33:48.500736Z"}],"euvd":[{"id":"EUVD-2006-7232","description":"XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes.\n\nA :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.","status":"published","published":"2026-03-19T11:03:46Z","modified":"2026-04-29T14:36:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:05:19.922616Z"}],"ghsa":[{"id":"GHSA-h943-hrx6-86cq","title":"XML::Parser versions through 2.47 for Perl could overflow the pre-allocated buffer size cause a...","description":"XML::Parser versions through 2.47 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes.\n\nA :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.","status":"published","published":"2026-03-19T12:30:32Z","modified":"2026-03-23T00:31:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:06:47.173687Z"}],"nvd":[{"id":"CVE-2006-10002","description":"XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes.\n\nA :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.","status":"published","published":"2026-03-19T12:16:16.12Z","modified":"2026-06-16T22:21:49.68Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-122","CWE-176"],"updated_at":"2026-11-02T14:01:10.996522Z"}],"osv":[{"id":"DEBIAN-CVE-2006-10002","description":"XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes.  A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.","status":"published","published":"2026-03-19T12:16:16.12Z","modified":"2026-10-23T00:00:47.753493756Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:22.831407Z"},{"id":"RHSA-2026:7679","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-13T10:07:25Z","modified":"2026-06-30T10:54:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7680","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-13T10:07:26Z","modified":"2026-06-30T10:54:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7681","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-13T10:07:26Z","modified":"2026-06-30T10:54:31Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:8577","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-17T10:09:46Z","modified":"2026-06-30T10:55:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8578","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-17T10:09:46Z","modified":"2026-06-30T10:55:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8608","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-17T10:09:46Z","modified":"2026-06-30T10:55:20Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8609","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-17T10:09:47Z","modified":"2026-06-30T10:55:21Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8610","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-17T10:09:48Z","modified":"2026-06-30T10:55:22Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:9110","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-21T10:10:58Z","modified":"2026-06-30T10:55:59Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RHSA-2026:9246","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-22T10:11:15Z","modified":"2026-06-30T10:56:04Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RHSA-2026:9258","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-22T10:11:15Z","modified":"2026-06-30T10:56:05Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RHSA-2026:9259","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-22T10:11:15Z","modified":"2026-06-30T10:56:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RHSA-2026:9605","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-22T10:11:31Z","modified":"2026-06-30T10:56:21Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2026:7679","title":"Important: perl-XML-Parser security update","description":"This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.\n\nSecurity Fix(es):\n\n* perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)\n\n* perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-15T12:03:53.750171Z","modified":"2026-04-15T12:30:29.596174Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7680","title":"Important: perl-XML-Parser security update","description":"This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.\n\nSecurity Fix(es):\n\n* perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)\n\n* perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-15T12:07:10.074197Z","modified":"2026-04-15T12:30:40.36418Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7681","title":"Important: perl-XML-Parser security update","description":"This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.\n\nSecurity Fix(es):\n\n* perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)\n\n* perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-14T12:01:12.815874Z","modified":"2026-04-14T12:30:06.967415Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2006-10002","description":"XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes. A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.","status":"published","published":"2026-03-19T12:16:00Z","modified":"2026-04-16T09:40:35.960201Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"ALSA-2026:7679","title":"Important: perl-XML-Parser security update","description":"This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.  \n\nSecurity Fix(es):  \n\n  * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)\n  * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-29T11:30:10.327000702Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7680","title":"Important: perl-XML-Parser security update","description":"This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.  \n\nSecurity Fix(es):  \n\n  * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)\n  * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-29T11:58:18.11574Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7681","title":"Important: perl-XML-Parser security update","description":"This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.  \n\nSecurity Fix(es):  \n\n  * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)\n  * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-29T11:02:29.707829308Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"MGASA-2026-0063","title":"Updated perl-XML-Parser packages fix security vulnerabilities","description":"XML::Parser versions through 2.47 for Perl could overflow the\npre-allocated buffer size causing a heap corruption (double free or\ncorruption) and crashes. (CVE-2006-10002)\nXML::Parser versions through 2.47 for Perl has an off-by-one heap buffer\noverflow in st_serial_stack. (CVE-2006-10003)\n","status":"published","published":"2026-03-24T17:53:34Z","modified":"2026-04-16T04:44:29.715218297Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10527-1","title":"perl-XML-Parser-2.570.0-1.1 on GA media","description":"These are all security issues fixed in the perl-XML-Parser-2.570.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-10T00:00:00Z","modified":"2026-04-11T08:01:10.60973Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20459-1","title":"Security update for perl-XML-Parser","description":"This update for perl-XML-Parser fixes the following issues:\n\n- CVE-2006-10002: heap buffer overflow in `parse_stream` when processing UTF-8 input streams (bsc#1259901).\n- CVE-2006-10003: off-by-one heap buffer overflow in `st_serial_stack` (bsc#1259902).\n","status":"published","published":"2026-04-01T16:23:38Z","modified":"2026-04-05T18:29:14.97305Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1152-1","title":"Security update for perl-XML-Parser","description":"This update for perl-XML-Parser fixes the following issues:\n\n- CVE-2006-10002: heap buffer overflow in `parse_stream` when processing UTF-8 input streams (bsc#1259901).\n- CVE-2006-10003: off-by-one heap buffer overflow in `st_serial_stack` (bsc#1259902).\n","status":"published","published":"2026-03-31T08:28:50Z","modified":"2026-04-01T08:00:11.143353Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1153-1","title":"Security update for perl-XML-Parser","description":"This update for perl-XML-Parser fixes the following issues:\n\n- CVE-2006-10002: heap buffer overflow in `parse_stream` when processing UTF-8 input streams (bsc#1259901).\n- CVE-2006-10003: off-by-one heap buffer overflow in `st_serial_stack` (bsc#1259902).\n","status":"published","published":"2026-03-31T08:40:07Z","modified":"2026-04-01T08:00:10.816577Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20993-1","title":"Security update for perl-XML-Parser","description":"This update for perl-XML-Parser fixes the following issues:\n\n- CVE-2006-10002: heap buffer overflow in `parse_stream` when processing UTF-8 input streams (bsc#1259901).\n- CVE-2006-10003: off-by-one heap buffer overflow in `st_serial_stack` (bsc#1259902).\n","status":"published","published":"2026-04-01T16:24:24Z","modified":"2026-04-10T18:33:44.857042Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"USN-8174-1","title":"libxml-parser-perl vulnerabilities","description":"It was discovered that XML::Parser incorrectly handled certain multi-byte\nUTF-8 characters. If a user or automated system were tricked into\nprocessing specially crafted XML data, a remote attacker could use this\nissue to cause XML::Parser to crash, resulting in a denial of service or to\npossibly execute arbitrary code. (CVE-2006-10002)\n\nIt was discovered that XML::Parser incorrectly handled very deep element\nnesting. If a user or automated system were tricked into processing\nspecially crafted XML data, a remote attacker could use this issue to cause\nXML::Parser to crash, resulting in a denial of service or to possibly\nexecute arbitrary code (CVE-2006-10003)","status":"published","published":"2026-04-14T08:13:19Z","modified":"2026-06-30T18:15:49.179475816Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}