In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

Affected Package

OS OS Version Package Name Package Version
Alpine edge-community firefox-esr 68.2.0-r0
Alpine edge-community firefox 70.0-r0
Alpine edge-main expat 2.2.7-r1
Alpine 3.10-community python2-tkinter 2.7.17-r0
Alpine 3.10-main expat 2.2.7-r1
Alpine 3.10-main python2 2.7.17-r0
Alpine 3.11-community firefox-esr 68.2.0-r0
Alpine 3.11-community python2-tkinter 2.7.17-r0
Alpine 3.11-main expat 2.2.7-r1
Alpine 3.11-main python2 2.7.17-r0
Alpine 3.12-community firefox-esr 68.2.0-r0
Alpine 3.12-community firefox 70.0-r0
Alpine 3.12-main expat 2.2.7-r1
Alpine 3.12-main python2 2.7.17-r0
Alpine 3.13-community firefox-esr 68.2.0-r0
Alpine 3.13-community firefox 70.0-r0
Alpine 3.13-community python2 2.7.17-r0
Alpine 3.13-main expat 2.2.7-r1
Alpine 3.14-community firefox-esr 68.2.0-r0
Alpine 3.14-community firefox 70.0-r0
Alpine 3.14-community python2 2.7.17-r0
Alpine 3.14-main expat 2.2.7-r1
Alpine 3.15-community firefox-esr 68.2.0-r0
Alpine 3.15-community firefox 70.0-r0
Alpine 3.15-community python2 2.7.17-r0
Alpine 3.15-main expat 2.2.7-r1
Alpine 3.16-community firefox-esr 68.2.0-r0
Alpine 3.16-community firefox 70.0-r0
Alpine 3.16-main expat 2.2.7-r1
Alpine 3.17-community firefox-esr 68.2.0-r0
Alpine 3.17-community firefox 70.0-r0
Alpine 3.17-main expat 2.2.7-r1
Alpine 3.18-community firefox-esr 68.2.0-r0
Alpine 3.18-community firefox 70.0-r0
Alpine 3.18-main expat 2.2.7-r1
Alpine 3.7-main expat 2.2.7-r1
Alpine 3.8-main expat 2.2.7-r1
Alpine 3.9-main expat 2.2.7-r1
Alpine 3.9-main python2 2.7.17-r0