CVE-2019-20007

An issue was discovered in ezXML 0.8.2 through 0.8.6

published December 26, 2019

CVSS
—
EPSS
1%
Percentile
67.6
In the wild
Unconfirmed
What it is

An issue was discovered in ezXML 0.8.2 through 0.8.6. The function ezxml_str2utf8, while parsing a crafted XML file, performs zero-length reallocation in ezxml.c, leading to returning a NULL pointer (in some compilers). After this, the function ezxml_parse_str does not check whether the s variable is not NULL in ezxml.c, leading to a NULL pointer dereference and crash (segmentation fault).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01185 · 67.6th percentile
Published
2019-12-26T21:55Z
EPSS history
Timeline
  • 26 DEC 21:55Z
    An issue was discovered in ezXML 0.8.2 through 0.8.6
    cvelistv5