CVE-2006-10002

CVE-2006-10002 affects XML::Parser for Perl up to version 2.47. The root cause is in A utf8 PerlIO layer, parse_stream() in Expat.xs where Perl's read() returns decoded characters while SvPV() provides multi-byte UTF-8 bytes, potentially overflowing the pre-allocated XML input buffer. This can le...

CVE-2006-10003

XML::Parser for Perl versions through 2.47 contains an off-by-one heap buffer overflow in st_serial_stack. When stackptr == stacksize - 1, the stack should not expand, yet the code writes to (++stackptr) which equals stacksize, falling outside the allocated buffer and enabling memory corruption u...