Vulnerabilities > CVE-2021-42260 - Infinite Loop vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

tinyxml-project

debian

CWE-835

NVD

Published: 2021-10-11

Updated: 2024-01-12

Summary

TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.

Vulnerable Configurations

Part	Description	Count
Application	Tinyxml_Project Tinyxml Project Tinyxml 2.3.0 Tinyxml Project Tinyxml 2.3.1 Tinyxml Project Tinyxml 2.3.2 Tinyxml Project Tinyxml 2.3.3 Tinyxml Project Tinyxml 2.3.4 Tinyxml Project Tinyxml 2.4.0 Tinyxml Project Tinyxml 2.4.1 Tinyxml Project Tinyxml 2.4.2 Tinyxml Project Tinyxml 2.4.3 Tinyxml Project Tinyxml 2.5.0 Tinyxml Project Tinyxml 2.5.1 Tinyxml Project Tinyxml 2.5.2 Tinyxml Project Tinyxml 2.5.3 Tinyxml Project Tinyxml 2.6.0 Tinyxml Project Tinyxml 2.6.1 Tinyxml Project Tinyxml 2.6.2	16
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0	2

Common Weakness Enumeration (CWE)

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References