oss-security - CVE-2006-10003: XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <416c62dde44caead4f52aac488b5de30@cpansec.org>
Date: Thu, 19 Mar 2026 08:09:25 -0300
From: Timothy Legge <timlegge@...nsec.org>
To: Cve Announce <cve-announce@...urity.metacpan.org>, Oss Security
 <oss-security@...ts.openwall.com>
Subject: CVE-2006-10003: XML::Parser versions through 2.47 for Perl has an
 off-by-one heap buffer overflow in st_serial_stack

========================================================================
CVE-2006-10003                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2006-10003
   Distribution:  XML-Parser
       Versions:  through 2.47

       MetaCPAN:  https://metacpan.org/dist/XML-Parser
       VCS Repo:  http://github.com/toddr/XML-Parser


XML::Parser versions through 2.47 for Perl has an off-by-one heap
buffer overflow in st_serial_stack

Description
-----------
XML::Parser versions through 2.47 for Perl has an off-by-one heap
buffer overflow in st_serial_stack.

In the case (stackptr == stacksize - 1), the stack will NOT be
expanded. Then the new value will be written at location (++stackptr),
which equals stacksize and therefore falls just outside the allocated
buffer.

The bug can be observed when parsing an XML file with very deep element
nesting

Problem types
-------------
- CWE-193 Off-by-one Error
- CWE-122 Heap-based Buffer Overflow

Workarounds
-----------
Apply the patch that has been publicly available since 2006-06-13.


Solutions
---------
Apply the patch that has been publicly available since 2006-06-13 or
upgrade to version 2.48 or later when it is released.


References
----------
https://rt.cpan.org/Ticket/Display.html?id=19860
https://github.com/cpan-authors/XML-Parser/issues/39
https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch

Timeline
--------
- 2006-06-13: Issue logged and patch provided in Request Tracker for
   XML::Parser
- 2019-09-23: Issue migrated to github issue tracker
- 2019-09-24: Patch provided in github issue tracker
- 2026-03-16: PR created and commit merged to git repo

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.