Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03OGgzLXBnNHgtajhjds4AA7ij

libxmljs2 vulnerable to type confusion when parsing specially crafted XML

libxmljs2 is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes XmlNode::get_local_namespaces()) on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service and remote code execution.

Permalink: https://github.com/advisories/GHSA-78h3-pg4x-j8cv
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03OGgzLXBnNHgtajhjds4AA7ij
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 7 months ago
Updated: 6 days ago

CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-78h3-pg4x-j8cv, CVE-2024-34394
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-34394
• https://github.com/marudor/libxmljs2/issues/205
• https://research.jfrog.com/vulnerabilities/libxmljs2-namespaces-type-confusion-rce-jfsa-2024-001034098
• https://github.com/advisories/GHSA-78h3-pg4x-j8cv

Repository: https://github.com/marudor/libxmljs2
Blast Radius: 24.9

Affected Packages