CVE-2006-10002: XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes
XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes.
A :utf8 PerlIO layer, parsestream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
XML::Parserto a version that resolves this vulnerability.Fixed in 2.46
Event History
Frequently Asked Questions
What is the severity of CVE-2006-10002?
CVE-2006-10002 is classified as a high severity vulnerability due to the potential for heap corruption leading to application crashes.
How do I fix CVE-2006-10002?
To fix CVE-2006-10002, upgrade XML::Parser to version 2.48 or later.
What systems are affected by CVE-2006-10002?
CVE-2006-10002 affects XML::Parser versions up to and including 2.47 for Perl.
What type of vulnerability is CVE-2006-10002?
CVE-2006-10002 is a buffer overflow vulnerability that can lead to heap corruption.
Can CVE-2006-10002 be exploited remotely?
Yes, CVE-2006-10002 can potentially be exploited remotely if an attacker is able to send specially crafted XML data to a vulnerable system.