libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.

libexpat before 2.8.2 has an integer overflow in storeAtts.

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.

libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.

xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.

libexpat before 2.8.2 has an integer overflow in addBinding.

libexpat before 2.8.2 has an integer overflow in copyString.

libexpat before 2.8.2 has an integer overflow in getAttributeId.