StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a crafted XML document with a '\0' located after whitespace.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade tinyxml | Oct 1, 2024 | Dec 13, 2023 |
| Debian | — | Upgrade tinyxml | Jan 8, 2024 | Dec 13, 2023 |
| Suse | — | Upgrade tinyxml-docsUpgrade tinyxml-develUpgrade libtinyxml0 | Dec 27, 2023 | Dec 13, 2023 |
| Ubuntu | — | Upgrade libtinyxml2.6.2v5Upgrade libtinyxml2.6.2v5 (Ubuntu Pro) | Jan 31, 2024 | Dec 13, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub