xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations

xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId

libexpat before 2.8.2 has an integer overflow in copyString

libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen

libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse

libexpat before 2.8.2 has an integer overflow in getAttributeId

libexpat before 2.8.2 has an integer overflow in addBinding

libexpat before 2.8.2 has an integer overflow in storeAtts

In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure…

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element

libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the…

libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy…

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of…

An issue was discovered in libexpat before 2.6.4

Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection…

libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition

libexpat before 2.7.5 allows an infinite loop while parsing DTD content

libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time

libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation