| Package | Affected versions | Patched versions |
|---|---|---|
| libexpat | < 2.2.8 | 2.2.8 |
| python | ≥ 2.7.0, < 2.7.17≥ 3.5.0, < 3.5.8≥ 3.6.0, < 3.6.10≥ 3.7.0, < 3.7.5 | 2.7.173.5.83.6.103.7.5 |
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free