CVE-2006-10002

Name of the Vulnerable Software and Affected Versions XML::Parser versions through 2.47

Description The software may experience a buffer overflow due to the pre-allocated buffer size being exceeded. This can lead to heap corruption, potentially resulting in a double free or other forms of corruption, and ultimately causing crashes. A PerlIO :utf8 layer, specifically the parse stream() function within Expat.xs, is susceptible to this issue. The problem arises because Perl’s read() function returns decoded characters, while SvPV() returns multi-byte UTF-8 bytes, which can exceed the buffer’s capacity.

Recommendations Update to a version of XML::Parser greater than 2.47.