CVE-2019-15903

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XMLGetCurrentLineNumber (or XMLGetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

Database specific

{
    "unresolved_ranges": [
        {
            "vendor_product": "python:python",
            "cpes": [
                "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
            ],
            "source": "CPE_RANGE",
            "extracted_events": [
                {
                    "introduced": "2.7.0"
                },
                {
                    "fixed": "2.7.17"
                },
                {
                    "introduced": "3.5.0"
                },
                {
                    "fixed": "3.5.8"
                },
                {
                    "introduced": "3.6.0"
                },
                {
                    "fixed": "3.6.10"
                },
                {
                    "introduced": "3.7.0"
                },
                {
                    "fixed": "3.7.5"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/libexpat/libexpat

Affected ranges

Type

GIT

Repo

https://github.com/libexpat/libexpat

Events

Introduced

Fixed

91b17cfeb8edf60ca23e33fe59ac231d0f2efb48

Fixed

c20b758c332d9a13afbbb276d30db1d183a85d43

Database specific

{
    "cpe": "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.2.8"
        }
    ]
}

Affected versions

Other

REC1_0

R_1_95_0

R_1_95_2

R_1_95_3

R_1_95_4

R_1_95_5

R_1_95_6

R_1_95_7

R_1_95_8

R_2_0_0

R_2_0_1

R_2_1_0

R_2_1_1

R_2_2_0

R_2_2_1

R_2_2_2

R_2_2_3

R_2_2_4

R_2_2_5

R_2_2_6

R_2_2_7

V1990307

V19981122

V19981231

V19990109

V19990425

V19990626

V19990709

V19990728

V19991013

V1_0

V1_1

V20000512

beta2

beta3

beta4

jclark-orig

libexpat-alpha-1

sourceforge_init

start

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-15903.json"