The expat XML parser code as used in the open source Jabber (jabberd) 1.4.3 and earlier jadc2s 0.9.0 and earlier and possibly other packages allows remote attackers to cause a denial of service (application crash) via a malformed packet to a socket that accepts XML connections.