Vulnerabilities > CVE-2023-34194 - Reachable Assertion vulnerability in Tinyxml Project Tinyxml
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a crafted XML document with a '\0' located after whitespace.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
References
- https://sourceforge.net/p/tinyxml/git/ci/master/tree/tinyxmlparser.cpp
- https://www.forescout.com/resources/sierra21-vulnerabilities
- https://lists.debian.org/debian-lts-announce/2023/12/msg00024.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOMBSHRIW5Q34SQSXYURYAOYDZD2NQF6/