CVE-2006-10002

Katalog CVE

CVSS 7.5 · High EPSS 0,60%

Kerentanan Heap-based Buffer Overflow pada toddr xml. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes. A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.

Rincian

Terbit di NVD

19 Maret 2026

Terakhir diubah

16 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow
CWE-176: Improper Handling of Unicode Encoding

EPSS (30 hari)

0,60% peluang dieksploitasi; lebih tinggi dari 47,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2026/03/19/1 mailing list · patch · advisory pihak ketiga
• https://github.com/cpan-authors/XML-Parser/commit/56b0509dfc6b559cd7555ea81ee62e3622069255.patch
• https://github.com/cpan-authors/XML-Parser/issues/64 issue tracking
• https://metacpan.org/release/TODDR/XML-Parser-2.46/changes
• https://rt.cpan.org/Ticket/Display.html?id=19859 mailing list
• http://www.openwall.com/lists/oss-security/2026/03/22/3