CVE-2023-34194

2023-12-1314:15:43

Debian Security Bug Tracker

security-tracker.debian.org

cve-2023-34194

stringequal

tixmldeclaration

parse

tinyxmlparser.cpp

tinyxml

xml document

assertion

application exit

crafted

whitespace

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

19.2%

JSON

StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a crafted XML document with a ‘\0’ located after whitespace.

OSVersionArchitecturePackageVersionFilename
Debian12alltinyxml< 2.6.2-6+deb12u1tinyxml_2.6.2-6+deb12u1_all.deb
Debian11alltinyxml< 2.6.2-4+deb11u2tinyxml_2.6.2-4+deb11u2_all.deb
Debian10alltinyxml< 2.6.2-4+deb10u2tinyxml_2.6.2-4+deb10u2_all.deb
Debian999alltinyxml< 2.6.2-6.1tinyxml_2.6.2-6.1_all.deb
Debian13alltinyxml< 2.6.2-6.1tinyxml_2.6.2-6.1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	tinyxml	< 2.6.2-6+deb12u1	tinyxml_2.6.2-6+deb12u1_all.deb
Debian	11	all	tinyxml	< 2.6.2-4+deb11u2	tinyxml_2.6.2-4+deb11u2_all.deb
Debian	10	all	tinyxml	< 2.6.2-4+deb10u2	tinyxml_2.6.2-4+deb10u2_all.deb
Debian	999	all	tinyxml	< 2.6.2-6.1	tinyxml_2.6.2-6.1_all.deb
Debian	13	all	tinyxml	< 2.6.2-6.1	tinyxml_2.6.2-6.1_all.deb