/ 
XML-Parser-2.18
Security Advisories (2)
CVE-2006-10002 (2026-03-19)

XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes. A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.

CVE-2006-10003 (2026-03-19)

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting

Changes for version 2.18

  • Alberto Accomazzi <alberto@cfa0.harvard.edu> pointed out that the DESTROY sub in the new XML::Parser::Encinfo package was pointing to the wrong package for calling FreeEncoding.
  • Tarang Kumar Patel <mombasa@ptolemy.arc.nasa.gov> reported the mis-declaration of an integer as unsigned in the convert_to_unicode function in Expat.xs.
  • Glenn R. Kronschnabl <grk@arlut.utexas.edu> reported a problem with ExternEnt handlers when using parsefile. Turned out to be an unmatched ENTER; SAVETMPS pair that screwed up the Perl stack.
  • Tom Hughes <tom@compton.demon.co.uk> reported that the fix I put in for the swith to PL_sv.. names failed with 5.0005_54, since these became real variables instead of macros. Switched to just checking the PATCHLEVEL macro.
  • Yoshida Masato <yoshidam@inse.co.jp> provided the EUC-JP encodings (the corresponding XML files are in XML::Encoding 1.01 or later.)
  • With the advice of MURATA Makoto <murata@apsdc.ksp.fujixerox.co.jp>, removed the Shift_JIS encoding and replaced it with 4 variations he provided. He also provided an explanatory message.
  • Added the recognized_string method to Expat, deprecating default_current.
  • Now using expat Version 19981122 from James Clark's test directory (this fixes another bug with external entity reference handlers)
  • Added a default external entity handler that only accesses file: based URLs.

Modules

XML::Parser::Expat
Lowlevel access to James Clark's expat XML parser
XML::Parser
A perl module for parsing XML documents

Provides

XML::Parser::Debug
in Parser.pm
XML::Parser::Encinfo
in Expat/Expat.pm
XML::Parser::Objects
in Parser.pm
XML::Parser::Stream
in Parser.pm
XML::Parser::Subs
in Parser.pm
XML::Parser::Tree
in Parser.pm

Examples

Other files