CVE-2006-10002: XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes
XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes. A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.
Affected Software
Remediation
Information
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-10002?
CVE-2006-10002 is classified as a high severity vulnerability due to the potential for heap corruption leading to application crashes.
How do I fix CVE-2006-10002?
To fix CVE-2006-10002, upgrade XML::Parser to version 2.48 or later.
What systems are affected by CVE-2006-10002?
CVE-2006-10002 affects XML::Parser versions up to and including 2.47 for Perl.
What type of vulnerability is CVE-2006-10002?
CVE-2006-10002 is a buffer overflow vulnerability that can lead to heap corruption.
Can CVE-2006-10002 be exploited remotely?
Yes, CVE-2006-10002 can potentially be exploited remotely if an attacker is able to send specially crafted XML data to a vulnerable system.