Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2026-1900)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1900 advisory. In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers...