| Package | Affected versions | Patched versions |
|---|---|---|
| libexpat | ≤ 2.9.0 |
libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free