perl-XML-Twig: The option to expandexternalents, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting.

Expat is vulnerable to a denial of service, caused by the improper handling of XML data by the big2toUtf8 function within the libexpat library. A remote attacker could exploit this vulnerability using a specially-crafted XML document containing malformed UTF-8 sequences that trigger a buffer over-read to cause the application to crash.