PT-2024-25854 · Libxmljs2 · Libxmljs2

Uriya Yavnieli · Published 2024-05-02 · Updated 2024-11-25 · CVE-2024-34393

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions libxmljs2 (affected versions not specified)

Description The issue is related to a type confusion vulnerability that occurs when parsing a specially crafted XML. This happens while invoking a function on the result of attrs() that was called on a parsed node. The vulnerability might lead to denial of service on both 32-bit and 64-bit systems, data leak, infinite loop, and remote code execution on 32-bit systems with the XML PARSE HUGE flag enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2024-34393

GHSA-MJR4-7XG5-PFVH

Affected Products

Libxmljs2

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-34393 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34393 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mjr4-7xg5-pfvh · Vendor Advisory
• https://github.com/marudor/libxmljs2/issues/204 · Note
• https://github.com/marudor/libxmljs2 · Note
• https://t.me/cvenotify/78915 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1786134389350338727 · Twitter Post
• https://twitter.com/CVEnew/status/1786114317584327060 · Twitter Post
• https://research.jfrog.com/vulnerabilities/libxmljs2-attrs-type-confusion-rce-jfsa-2024-001034097 · Note