kritisch
CVE-2006-10003
perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (hoch), AlmaLinux (hoch), Amazon (hoch), Azure Linux (hoch), Oracle (hoch), Rocky Linux (hoch), Ubuntu (mittel).
Beschreibung
XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 8 | perl-XML-Parser | 2.44-12.el8_10 |
| alma 9 | perl-XML-Parser | 2.46-9.1.el9_7 |
| amazon linux 2 | perl-XML-Parser, perl-XML-Parser-debuginfo | 2.41-10.amzn2.0.3 |
| amazon linux 2023 | perl-XML-Parser, perl-XML-Parser-debuginfo, perl-XML-Parser-debugsource und 1 weitere | 2.51-1.amzn2023.0.1 |
| Azure Linux 3.0 | perl-XML-Parser | 0:2.47-2.azl3 |
| debian 11 | libxml-parser-perl | 2.46-2+deb11u1 |
| debian 12 | libxml-parser-perl | 2.46-4+deb12u1 |
| debian 13 | libxml-parser-perl | 2.47-2~deb13u1 |
| debian 14 | libxml-parser-perl | 2.47-2 |
| echo | libxml-parser-perl | 2.46-4+deb12u1 |
| Oracle Linux 7 | perl-XML-Parser | 2.41-10.0.3.el7_9 |
| Oracle Linux 8 | perl-XML-Parser | 2.44-12.0.1.el8_10 |
Alle 34 Einträge aus 29 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alma 8 | perl-XML-Parser | 2.44-12.el8_10 |
| alma 9 | perl-XML-Parser | 2.46-9.1.el9_7 |
| amazon linux 2 | perl-XML-Parser | 2.41-10.amzn2.0.3 |
| amazon linux 2 | perl-XML-Parser-debuginfo | 2.41-10.amzn2.0.3 |
| amazon linux 2023 | perl-XML-Parser | 2.51-1.amzn2023.0.1 |
| amazon linux 2023 | perl-XML-Parser-debuginfo | 2.51-1.amzn2023.0.1 |
| amazon linux 2023 | perl-XML-Parser-debugsource | 2.51-1.amzn2023.0.1 |
| amazon linux 2023 | perl-XML-Parser-tests | 2.51-1.amzn2023.0.1 |
| Azure Linux 3.0 | perl-XML-Parser | 0:2.47-2.azl3 |
| debian 11 | libxml-parser-perl | 2.46-2+deb11u1 |
| debian 12 | libxml-parser-perl | 2.46-4+deb12u1 |
| debian 13 | libxml-parser-perl | 2.47-2~deb13u1 |
| debian 14 | libxml-parser-perl | 2.47-2 |
| echo | libxml-parser-perl | 2.46-4+deb12u1 |
| Oracle Linux 7 | perl-XML-Parser | 2.41-10.0.3.el7_9 |
| Oracle Linux 8 | perl-XML-Parser | 2.44-12.0.1.el8_10 |
| Oracle Linux 9 | perl-XML-Parser | 2.46-9.1.0.1.el9_7 |
| rapidfort amazon linux 2023 | perl-XML-Parser | 2.51-1.amzn2023.0.1 |
| rapidfort debian 12 | libxml-parser-perl | 0:2.47-2, 0:2.47-2~deb13u1 |
| rapidfort debian 13 | libxml-parser-perl | 0:2.47-2, 0:2.47-2~deb13u1 |
| rapidfort fedora 43 | perl-XML-Parser | 2.51-1.fc43 |
| rapidfort fedora 43 | perl-XML-Parser-tests | 2.51-1.fc43 |
| rapidfort Oracle Linux 10 | perl-XML-Parser | 0:2.47-6.1.0.1.el10_1 |
| rapidfort Oracle Linux 9 | perl-XML-Parser | 0:2.46-9.1.0.1.el9_7 |
| rapidfort ubuntu 20.04 | libxml-parser-perl | 0:2.46-3ubuntu0.1, 0:2.47-1ubuntu0.24.04.1 |
| rapidfort ubuntu 22.04 | libxml-parser-perl | 0:2.46-3ubuntu0.1, 0:2.47-1ubuntu0.24.04.1 |
| rapidfort ubuntu 24.04 | libxml-parser-perl | 0:2.46-3ubuntu0.1, 0:2.47-1ubuntu0.24.04.1 |
| Red Hat | perl-XML-Parser | kein Fix angegeben |
| rocky 10 | perl-XML-Parser | 2.47-6.1.el10_1 |
| rocky 8 | perl-XML-Parser | 2.44-12.el8_10 |
| rocky 9 | perl-XML-Parser | 2.46-9.1.el9_7 |
| ubuntu 22.04 | libxml-parser-perl | 2.46-3ubuntu0.1 |
| ubuntu 24.04 | libxml-parser-perl | 2.47-1ubuntu0.24.04.1 |
| ubuntu 25.10 | libxml-parser-perl | 2.47-1ubuntu0.25.10.1 |
Referenzen
- http://www.openwall.com/lists/oss-security/2026/03/19/2
- https://access.redhat.com/errata/RHSA-2026:7679
- https://access.redhat.com/errata/RHSA-2026:7680
- https://access.redhat.com/errata/RHSA-2026:7681
- https://access.redhat.com/errata/RHSA-2026:8577
- https://access.redhat.com/errata/RHSA-2026:8578
- https://access.redhat.com/errata/RHSA-2026:8608
- https://access.redhat.com/errata/RHSA-2026:8609
Alle 35 Referenzen
- https://access.redhat.com/errata/RHSA-2026:8610
- https://access.redhat.com/errata/RHSA-2026:9110
- https://access.redhat.com/errata/RHSA-2026:9246
- https://access.redhat.com/errata/RHSA-2026:9258
- https://access.redhat.com/errata/RHSA-2026:9259
- https://access.redhat.com/errata/RHSA-2026:9605
- https://access.redhat.com/security/cve/CVE-2006-10003
- https://bugzilla.redhat.com/2448999
- https://bugzilla.redhat.com/2449001
- https://bugzilla.redhat.com/show_bug.cgi?id=2448999
- https://bugzilla.redhat.com/show_bug.cgi?id=2449001
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-10002
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-10003
- https://errata.almalinux.org/9/ALSA-2026-7679.html
- https://errata.rockylinux.org/RLSA-2026:7679
- https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch
- https://github.com/cpan-authors/XML-Parser/issues/39
- https://linux.oracle.com/cve/CVE-2006-10003.html
- https://linux.oracle.com/errata/ELSA-2026-8578.html
- https://lists.debian.org/debian-lts-announce/2026/04/msg00002.html
- https://lists.security.metacpan.org/cve-announce/msg/38106362/
- https://nvd.nist.gov/vuln/detail/CVE-2006-10003
- https://rt.cpan.org/Ticket/Display.html?id=19860
- https://security.access.redhat.com/data/csaf/v2/vex/2006/cve-2006-10003.json
- https://ubuntu.com/security/notices/USN-8174-1
- https://www.cve.org/CVERecord?id=CVE-2006-10003