Medium · published February 18, 2022
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
| Product | Versions | Fixed in |
|---|---|---|
| libexpat_project/libexpat | < 2.4.5 | 2.4.5 |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| oracle/http_server | all versions | — |
| oracle/http_server | all versions | — |
| oracle/zfs_storage_appliance_kit | all versions | — |
| siemens/sinema_remote_connect_server | < 3.1 | 3.1 |