Here's the original press release from the company:

http://www.codenomicon.com/news/press-releases/2009-08-05.sh...

And a CERT-FI advisory:

http://www.cert.fi/en/reports/2009/vulnerability2009085.html

Also the expat-bug and expat-discuss mailing lists were very active in January/February with seemly related issues:

http://mail.libexpat.org/pipermail/expat-bugs/2009-January/t...

http://mail.libexpat.org/pipermail/expat-discuss/2009-Februa...