PT-2019-6370 · Ezxml+3 · Ezxml+3
Publicado
2019-12-30
·
Atualizado
2021-12-23
·
CVE-2019-20199
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
ezXML versions 0.8.3 through 0.8.6
Description
The issue is related to the
ezxml decode function in the ezXML library, which performs incorrect memory handling while parsing a crafted XML file. This leads to a NULL pointer dereference when running strlen() on a NULL pointer. The vulnerability allows a remote attacker to cause a denial of service using a specially crafted XML file. The vulnerability is related to reading beyond the boundaries of a data buffer.Recommendations
For ezXML versions 0.8.3 through 0.8.6, consider disabling the
ezxml decode function until a patch is available to prevent exploitation. Restrict access to the ezXML library to minimize the risk of denial of service attacks. Avoid using the ezxml decode function with untrusted XML files until the issue is resolved.Exploit
Correção
Out of bounds Read
NULL Pointer Dereference
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Astra Linux
Debian
Suse
Ezxml