[SECURITY] [DLA 3701-1] tinyxml security update

2023-12-3023:15:38

lists.debian.org

tinyxml

xml parsing

denial of service

assertion issue

debian 10 buster

security update

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

20.3%

JSON

Debian LTS Advisory DLA-3701-1 [email protected]
https://www.debian.org/lts/security/ Guilhem Moulin
December 31, 2023 https://wiki.debian.org/LTS

Package : tinyxml
Version : 2.6.2-4+deb10u2
CVE ID : CVE-2023-34194 CVE-2023-40462
Debian Bug : 1059315

A reachable assertion issue has been discovered in tinyxml, a C++ XML
parsing library, which could lead to denial of service via a crafted XML
document with a '\0' located after whitespace.

For Debian 10 buster, these problems have been fixed in version
2.6.2-4+deb10u2.

We recommend that you upgrade your tinyxml packages.

For the detailed security status of tinyxml please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/tinyxml

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian10i386libtinyxml2.6.2v5< 2.6.2-4+deb10u2libtinyxml2.6.2v5_2.6.2-4+deb10u2_i386.deb
Debian12armellibtinyxml2.6.2v5-dbgsym< 2.6.2-6+deb12u1libtinyxml2.6.2v5-dbgsym_2.6.2-6+deb12u1_armel.deb
Debian12alltinyxml< 2.6.2-6+deb12u1tinyxml_2.6.2-6+deb12u1_all.deb
Debian11armhflibtinyxml2.6.2v5< 2.6.2-4+deb11u2libtinyxml2.6.2v5_2.6.2-4+deb11u2_armhf.deb
Debian12amd64libtinyxml2.6.2v5-dbgsym< 2.6.2-6+deb12u1libtinyxml2.6.2v5-dbgsym_2.6.2-6+deb12u1_amd64.deb
Debian12i386libtinyxml2.6.2v5-dbgsym< 2.6.2-6+deb12u1libtinyxml2.6.2v5-dbgsym_2.6.2-6+deb12u1_i386.deb
Debian10amd64libtinyxml2.6.2v5< 2.6.2-4+deb10u2libtinyxml2.6.2v5_2.6.2-4+deb10u2_amd64.deb
Debian11armellibtinyxml2.6.2v5-dbg< 2.6.2-4+deb11u2libtinyxml2.6.2v5-dbg_2.6.2-4+deb11u2_armel.deb
Debian12s390xlibtinyxml-dev< 2.6.2-6+deb12u1libtinyxml-dev_2.6.2-6+deb12u1_s390x.deb
Debian12amd64libtinyxml2.6.2v5< 2.6.2-6+deb12u1libtinyxml2.6.2v5_2.6.2-6+deb12u1_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	i386	libtinyxml2.6.2v5	< 2.6.2-4+deb10u2	libtinyxml2.6.2v5_2.6.2-4+deb10u2_i386.deb
Debian	12	armel	libtinyxml2.6.2v5-dbgsym	< 2.6.2-6+deb12u1	libtinyxml2.6.2v5-dbgsym_2.6.2-6+deb12u1_armel.deb
Debian	12	all	tinyxml	< 2.6.2-6+deb12u1	tinyxml_2.6.2-6+deb12u1_all.deb
Debian	11	armhf	libtinyxml2.6.2v5	< 2.6.2-4+deb11u2	libtinyxml2.6.2v5_2.6.2-4+deb11u2_armhf.deb
Debian	12	amd64	libtinyxml2.6.2v5-dbgsym	< 2.6.2-6+deb12u1	libtinyxml2.6.2v5-dbgsym_2.6.2-6+deb12u1_amd64.deb
Debian	12	i386	libtinyxml2.6.2v5-dbgsym	< 2.6.2-6+deb12u1	libtinyxml2.6.2v5-dbgsym_2.6.2-6+deb12u1_i386.deb
Debian	10	amd64	libtinyxml2.6.2v5	< 2.6.2-4+deb10u2	libtinyxml2.6.2v5_2.6.2-4+deb10u2_amd64.deb
Debian	11	armel	libtinyxml2.6.2v5-dbg	< 2.6.2-4+deb11u2	libtinyxml2.6.2v5-dbg_2.6.2-4+deb11u2_armel.deb
Debian	12	s390x	libtinyxml-dev	< 2.6.2-6+deb12u1	libtinyxml-dev_2.6.2-6+deb12u1_s390x.deb
Debian	12	amd64	libtinyxml2.6.2v5	< 2.6.2-6+deb12u1	libtinyxml2.6.2v5_2.6.2-6+deb12u1_amd64.deb