PT-2019-6362 · Ezxml+3 · Ezxml+3
Cve Reporting
·
Publicado
2019-12-31
·
Atualizado
2021-12-23
·
CVE-2019-20198
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
ezXML versions 0.8.3 through 0.8.6
Description
The issue is related to the
ezxml ent ok() function, which mishandles recursion. This can lead to stack consumption when processing a crafted XML file, potentially allowing a remote attacker to cause a denial of service.Recommendations
For ezXML versions 0.8.3 through 0.8.6, consider disabling the
ezxml ent ok() function as a temporary workaround until a patch is available. Restrict access to crafted XML files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Uncontrolled Recursion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Astra Linux
Debian
Suse
Ezxml