PT-2021-7865 · Ezxml+3 · Ezxml+3
Rc0R
·
Published
2021-04-16
·
Updated
2022-07-30
·
CVE-2021-31348
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
ezXML version 0.8.6
Description
The issue is related to the
ezxml parse str() function in the ezXML library, which performs incorrect memory handling while parsing crafted XML files, leading to an out-of-bounds read after a certain strcspn failure. This can be exploited by a remote attacker to cause a denial of service using a specially crafted XML file.Recommendations
For ezXML version 0.8.6, consider disabling the
ezxml parse str() function as a temporary workaround until a patch is available. Restrict the use of crafted XML files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Debian
Suse
Ezxml