What’s Vulnerable › Vulnerabilities

CVE-2019-15903

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-09-04 · updated 2026-10-14
• Weakness: CWE-125

Description

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

Affected products

• libexpat project libexpat: before 2.2.8 — fixed in 2.2.8
• Python: from 2.7.0 before 2.7.17; from 3.5.0 before 3.5.8; from 3.6.0 before 3.6.10; from 3.7.0 before 3.7.5 — fixed in 2.7.17, 3.5.8, 3.6.10, 3.7.5

How to fix

Upgrade to a fixed version: libexpat project libexpat 2.2.8; Python 2.7.17, 3.5.8, 3.6.10, 3.7.5. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html

Get alerted when CVE-2019-15903 or the next vulnerability affects your stack