CVE-2023-34194

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-34194
StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a crafted XML document with a '\0' located after whitespace.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://lists.debian.org/debian-lts-announce/2023/12/msg00024.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOMBSHRIW5Q34SQSXYURYAOYDZD2NQF6/
https://sourceforge.net/p/tinyxml/git/ci/master/tree/tinyxmlparser.cpp Patch
https://www.forescout.com/resources/sierra21-vulnerabilities Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:tinyxml_project:tinyxml:*:*:*:*:*:*:*:*
History

12 Jan 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOMBSHRIW5Q34SQSXYURYAOYDZD2NQF6/ -

08 Jan 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE/ -

31 Dec 2023, 00:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2023/12/msg00024.html -

18 Dec 2023, 18:31

Type Values Removed Values Added
CPE cpe:2.3:a:tinyxml_project:tinyxml:*:*:*:*:*:*:*:*
CWE CWE-617
Summary
  • (es) StringEqual en TiXmlDeclaration::Parse en tinyxmlparser.cpp en TinyXML hasta 2.6.2 tiene una aserción accesible (y una salida de la aplicación) a través de un documento XML manipulado con un '\0' ubicado después del espacio en blanco.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Tinyxml Project
Tinyxml Project tinyxml
References () https://sourceforge.net/p/tinyxml/git/ci/master/tree/tinyxmlparser.cpp - () https://sourceforge.net/p/tinyxml/git/ci/master/tree/tinyxmlparser.cpp - Patch
References () https://www.forescout.com/resources/sierra21-vulnerabilities - () https://www.forescout.com/resources/sierra21-vulnerabilities - Third Party Advisory

13 Dec 2023, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-13 14:15

Updated : 2024-01-12 03:15

NVD link : CVE-2023-34194

Mitre link : CVE-2023-34194

CVE.ORG link : CVE-2023-34194

JSON object : View

Products Affected

tinyxml_project

  • tinyxml
CWE
CWE-617

Reachable Assertion