NetSight
IP …
high7.5

CVE-2019-15903

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCu…

Impact

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

Affected products

VendorProductAffected versions
Libexpat ProjectLibexpat
before 2.2.8
PythonPython
from 2.7.0 before 2.7.17
from 3.5.0 before 3.5.8
from 3.6.0 before 3.6.10
from 3.7.0 before 3.7.5

Weakness classification

CWE-125CWE-776

References