CVE-2018-20004 An issue has been found in Mini-XML (aka mxml) 2.12. It is a stack-based buffer overflow in mxml_write_node in mxml-file.c via vectors involving a double-precision floating point number and the '<orde...
HighCVSS 8.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue has been found in Mini-XML (aka mxml) 2.12. It is a stack-based buffer overflow in mxml_write_node in mxml-file.c via vectors involving a double-precision floating point number and the '<order type="real">' substring, as demonstrated by testmxml.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mxml(Debian:12) | < 2.12-2 | 2.12-2 |
| debian/mxml(Debian:13) | < 2.12-2 | 2.12-2 |
| debian/mxml(Debian:14) | < 2.12-2 | 2.12-2 |
| mini-xml project mini-xml | = 2.12 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| fedoraproject fedora | = 28 | No fix listed |
| fedoraproject fedora | = 29 | No fix listed |
References
- Debian Security Tracker CVE-2018-20004 vendor-advisory
- github.com exploit third-party-advisory
- github.com exploit third-party-advisory
- [debian-lts-announce] 20190125 [SECURITY] [DLA 1641-1] mxml security update mailing-list third-party-advisory
- FEDORA-2019-d333d01e08 vendor-advisory
- FEDORA-2019-f99619e34d vendor-advisory
- bugs.debian.org issue-tracking