CVE-2021-45960: Buffer Overflow
Expat (aka libexpat) is vulnerable to a denial of service, caused by a realloc misbehavior issue in the storeAtts function in xmlparse.c. By persuading a victim to open a specially-crafted XML content, a remote attacker could exploit this vulnerability to cause a the application to crash.
Other sources
expat (libexpat) is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to buffer overrun. The highest threat from this vulnerability is to availability.
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-45960?
CVE-2021-45960 is a vulnerability in Expat (libexpat) which can cause process interruption and unexpected termination due to buffer overrun when processing a large number of prefixed XML attributes on a single tag.
What is the severity of CVE-2021-45960?
The severity of CVE-2021-45960 is critical with a CVSS score of 8.8.
Which software is affected by CVE-2021-45960?
Expat (libexpat) versions prior to 2.4.3 are affected by CVE-2021-45960.
How can I fix CVE-2021-45960?
To fix CVE-2021-45960, update Expat (libexpat) to version 2.4.3 or later.
Are there any references for CVE-2021-45960?
Yes, you can find references for CVE-2021-45960 at the following links: [Link 1](https://github.com/libexpat/libexpat/issues/531), [Link 2](https://github.com/libexpat/libexpat/pull/534), [Link 3](https://bugzilla.mozilla.org/show_bug.cgi?id=1217609).