In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
Weakness
The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libexpat | Libexpat_project | * | 2.8.2 (excluding) |
| Red Hat Hardened Images | RedHat | expat-main-2.8.2-1.hum1 | * |
| Cadaver | Ubuntu | questing | * |
| Expat | Ubuntu | questing | * |
| Matanza | Ubuntu | devel | * |
| Matanza | Ubuntu | esm-apps/focal | * |
| Matanza | Ubuntu | esm-apps/jammy | * |
| Matanza | Ubuntu | esm-apps/noble | * |
| Matanza | Ubuntu | esm-apps/resolute | * |
| Matanza | Ubuntu | jammy | * |
| Matanza | Ubuntu | noble | * |
| Matanza | Ubuntu | questing | * |
| Matanza | Ubuntu | resolute | * |
| Swish-e | Ubuntu | questing | * |
| Tdom | Ubuntu | questing | * |
| Wbxml2 | Ubuntu | questing | * |
| Xmlrpc-c | Ubuntu | questing | * |