CVE-2006-10002
MediumSummary
A vulnerability in the XML::Parser library for Perl (up to version 2.45) causes a heap buffer overflow, leading to double free or corruption and crashes. The issue occurs in the parse_stream() function in Expat.xs when the :utf8 PerlIO layer is used, because Perl returns decoded characters while SvPV() expects raw bytes.
Risk Assessment
An attacker can exploit this vulnerability to crash applications processing XML data, leading to denial of service (DoS). In extreme cases, memory corruption may allow remote code execution.
Recommendation
Immediately update XML::Parser to version 2.46 or later, which includes the fix. If an update is not possible, avoid using the :utf8 layer when parsing XML with XML::Parser.
Original NVD description (English source)
XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes. A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV()