Cloudanix VulnDB

CVE-2006-10003

Critical · 9.8

CVSS

9.8

EPSS

0.5%

Published

Mar 19, 2026

CISA due date

—

The record

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting

Affected packages

Ecosystem Package Introduced Fixed
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS perl-XML-Parser 0 2.44-150000.3.3.1
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS perl-XML-Parser 0 2.44-150000.3.3.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS perl-XML-Parser 0 2.44-150000.3.3.1
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS perl-XML-Parser 0 2.44-150000.3.3.1
SUSE:Linux Enterprise Module for Basesystem 15 SP7 perl-XML-Parser 0 2.44-150000.3.3.1
SUSE:Linux Enterprise Server 15 SP4-LTSS perl-XML-Parser 0 2.44-150000.3.3.1
SUSE:Linux Enterprise Server 15 SP5-LTSS perl-XML-Parser 0 2.44-150000.3.3.1
SUSE:Linux Enterprise Server 15 SP6-LTSS perl-XML-Parser 0 2.44-150000.3.3.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP4 perl-XML-Parser 0 2.44-150000.3.3.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP5 perl-XML-Parser 0 2.44-150000.3.3.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 perl-XML-Parser 0 2.44-150000.3.3.1
openSUSE:Leap 15.6 perl-XML-Parser 0 2.44-150000.3.3.1
openSUSE:Leap 16.0 perl-XML-Parser 0 2.470.0-160000.3.1
openSUSE:Tumbleweed perl-XML-Parser 0 2.570.0-1.1

Related vulnerabilities