CVE-2023-34194

2023-12-1300:00:00

ubuntu.com

cve-2023-34194

tinyxml

xml

assertion

reachable

crafted document

vulnerability

0.001 Low

EPSS

Percentile

19.2%

JSON

StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML
through 2.6.2 has a reachable assertion (and application exit) via a
crafted XML document with a ‘\0’ located after whitespace.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059315>

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchtinyxml< 2.6.2-4ubuntu0.18.04.1~esm2UNKNOWN
ubuntu20.04noarchtinyxml< 2.6.2-4+deb10u2build0.20.04.1UNKNOWN
ubuntu22.04noarchtinyxml< 2.6.2-6ubuntu0.22.04.1UNKNOWN
ubuntu23.10noarchtinyxml< 2.6.2-6ubuntu0.23.10.1UNKNOWN
ubuntu16.04noarchtinyxml< 2.6.2-3ubuntu0.1~esm2) Available with Ubuntu Pro or Ubuntu Pro (Infra-onlyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	tinyxml	< 2.6.2-4ubuntu0.18.04.1~esm2	UNKNOWN
ubuntu	20.04	noarch	tinyxml	< 2.6.2-4+deb10u2build0.20.04.1	UNKNOWN
ubuntu	22.04	noarch	tinyxml	< 2.6.2-6ubuntu0.22.04.1	UNKNOWN
ubuntu	23.10	noarch	tinyxml	< 2.6.2-6ubuntu0.23.10.1	UNKNOWN
ubuntu	16.04	noarch	tinyxml	< 2.6.2-3ubuntu0.1~esm2) Available with Ubuntu Pro or Ubuntu Pro (Infra-only	UNKNOWN