Veracode Vulnerability DatabaseVERACODE:44759Denial Of Service (DoS)
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
20.3%
libtinyxml.so is vulnerable to Denial Of Service (DoS). The vulnerability arises due to a reachable assertion in tinyxmlparser.cpp. An attacker can potentially crash the application via a crafted XML document with a \0 located after a whitespace.
References
bugzilla.suse.com/show_bug.cgi?id=1218040
lists.debian.org/debian-lts-announce/2023/12/msg00024.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOMBSHRIW5Q34SQSXYURYAOYDZD2NQF6/
sourceforge.net/p/tinyxml/git/ci/master/tree/tinyxmlparser.cpp
www.forescout.com/resources/sierra21-vulnerabilities
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
20.3%