CVE-2019-15903

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-15903
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15903.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-15903
Downstream
ALPINE (1)
BELL (1)
CLEANSTART (5)
CLSA (2)
DEBIAN (1)
JLSEC (1)
MGASA (3)
openSUSE (19)
RHSA (9)
RLSA (1)
SUSE (10)
UBUNTU (1)
Related
openSUSE (19)
SUSE (10)
Published
2019-09-04T06:15:10Z
Modified
2026-10-22T07:08:37Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "2.7.0"
                        },
                        {
                            "fixed":  "2.7.17"
                        },
                        {
                            "introduced":  "3.5.0"
                        },
                        {
                            "fixed":  "3.5.8"
                        },
                        {
                            "introduced":  "3.6.0"
                        },
                        {
                            "fixed":  "3.6.10"
                        },
                        {
                            "introduced":  "3.7.0"
                        },
                        {
                            "fixed":  "3.7.5"
                        }
                    ],
                    "source":  "CPE_RANGE"
                }
            ],
            "vendor_product":  "python:python"
        }
    ]
}
References

Affected packages

Git / github.com/libexpat/libexpat

Affected ranges

Type
GIT
Repo
https://github.com/libexpat/libexpat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
91b17cfeb8edf60ca23e33fe59ac231d0f2efb48
Fixed
c20b758c332d9a13afbbb276d30db1d183a85d43
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.2.8"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "c20b758c332d9a13afbbb276d30db1d183a85d43"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
REC1_0
R_1_95_0
R_1_95_2
R_1_95_3
R_1_95_4
R_1_95_5
R_1_95_6
R_1_95_7
R_1_95_8
R_2_0_0
R_2_0_1
R_2_1_0
R_2_1_1
R_2_2_0
R_2_2_1
R_2_2_2
R_2_2_3
R_2_2_4
R_2_2_5
R_2_2_6
R_2_2_7
V1990307
V19981122
V19981231
V19990109
V19990425
V19990626
V19990709
V19990728
V19991013
V1_0
V1_1
V20000512
beta2
beta3
beta4
jclark-orig
libexpat-alpha-1
sourceforge_init
start

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15903.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "125271961576543742310629350504968019617",
            "length":  27888
        },
        "id":  "CVE-2019-15903-0d752d8d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43",
        "target":  {
            "file":  "expat/lib/xmlparse.c",
            "function":  "doProlog"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "258898664727023212628731136448884091064",
            "length":  1541
        },
        "id":  "CVE-2019-15903-3992c034",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43",
        "target":  {
            "file":  "expat/lib/xmlparse.c",
            "function":  "processInternalEntity"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "320542276707726540903784573260106917696",
            "length":  347
        },
        "id":  "CVE-2019-15903-4fa8a18a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43",
        "target":  {
            "file":  "expat/lib/xmlparse.c",
            "function":  "prologProcessor"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "87559746390753119708030472024368882252",
            "length":  1691
        },
        "id":  "CVE-2019-15903-50a68847",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43",
        "target":  {
            "file":  "expat/lib/xmlparse.c",
            "function":  "internalEntityProcessor"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "132983735470197785746052135782572205033",
                "146204224061470080606983094059913412689",
                "7599560151177139529648421590374092798",
                "43488536384691544214046994497908120940",
                "316924857856242392275636406882952016268",
                "313502711495946994497639020874340401069",
                "195484947523758424504813833072420643936",
                "66393858657853185419579310156918223010",
                "255221502895981869157887834697152878351",
                "106795823336306937525621181615350467828",
                "226320368211189727652238023669300150723",
                "120536527396395186340591214598221850705",
                "157897276731025067219377731738911663661",
                "56387941961793144568065674959231386429",
                "122849457964806115309741096903856490512",
                "175297395996681036848075065183921967929",
                "299387118000825267278833341847060218101",
                "276502891951823894309157759029430923936",
                "56631634594391992920425749299177991860",
                "128211256018775436878936886506812361210",
                "136991866931827280169215334671955339519",
                "267326537430448345157071811058789050241",
                "281089508152999328292147815149430177071",
                "266760975306673981287073430543841070947",
                "136991866931827280169215334671955339519",
                "267326537430448345157071811058789050241",
                "281089508152999328292147815149430177071",
                "145115243084578848234012712515518269345",
                "130000406535845302189293374835665079658",
                "249245281332386594223044783888918985169",
                "150401336559048452177710326613018819487",
                "41422063577574542654899415359947089205"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2019-15903-52ad81f3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43",
        "target":  {
            "file":  "expat/lib/xmlparse.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "217326096847551269990637517059988824832",
            "length":  878
        },
        "id":  "CVE-2019-15903-9c136d97",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43",
        "target":  {
            "file":  "expat/lib/xmlparse.c",
            "function":  "externalParEntProcessor"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T07:08:37Z"