CVE-2019-20007
Medium
Description
An issue was discovered in ezXML 0.8.2 through 0.8.6. The function ezxml_str2utf8, while parsing a crafted XML file, performs zero-length reallocation in ezxml.c, leading to returning a NULL pointer (in some compilers). After this, the function ezxml_parse_str does not check whether the s variable is not NULL in ezxml.c, leading to a NULL pointer dereference and crash (segmentation fault).
SeverityMedium
CVSS6.5
Exploit probability—
ProductEzxml
PublishedDec 26, 2019
First seenDec 26, 2019
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ezxml_project ezxml | 0.8.2 ≤ v ≤ 0.8.6 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.