Heap Corruption in XML::Parser for Perl by Exit Data
CVE-2006-10002
9.8CRITICAL
What is CVE-2006-10002?
The XML::Parser module for Perl, specifically versions up to 2.47, is susceptible to a vulnerability that allows for a heap corruption issue due to an overflow of the pre-allocated buffer size. This occurs in the parse_stream() function within Expat.xs, where the Perl read() function returns decoded characters that can exceed the limitations set by the SvPV() function. This discrepancy can result in double free or corruption scenarios, ultimately leading to application crashes. It is crucial for users to be aware of this vulnerability and apply any necessary patches to mitigate potential risks.
Affected Version(s)
XML::Parser 0 <= 2.45