IM
IronMonkey Threat Research

CVE-2024-34459 HIGH

Published: 2024-05-14 | Last Modified: 2025-11-04 | Status: Modified

Description

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.

Additional Descriptions (1)

Se descubrió un problema en xmllint (de libxml2) anterior a 2.11.8 y 2.12.x anterior a 2.12.7. Formatear mensajes de error con xmllint --htmlout puede provocar una lectura excesiva del búfer en xmlHTMLPrintFileContext en xmllint.c.

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactNONE
Availability ImpactNONE

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Type: Secondary

Exploitability Score: 3.9

Impact Score: 3.6

Weaknesses

Source Type Description
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-122

Affected Products

Vendor Product Version Update Type
xmlsoft libxml2 * <built-in method update of dict object at 0x7fd340144a00> Application
xmlsoft libxml2 * <built-in method update of dict object at 0x7fd2d814a840> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*

References