CVE-2019-20005

{"id": "CVE-2019-20005", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2019-12-26T22:15:10.797", "references": [{"url": "https://sourceforge.net/p/ezxml/bugs/14/", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://sourceforge.net/p/ezxml/bugs/14/", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, performs incorrect memory handling, leading to a heap-based buffer over-read while running strchr() starting with a pointer after a '\\0' character (where the processing of a string was finished)."}, {"lang": "es", "value": "Se detect\u00f3 un problema en ezXML versiones 0.8.3 hasta 0.8.6. La funci\u00f3n ezxml_decode, mientras analiza un archivo XML dise\u00f1ado, realiza un manejo incorrecto de la memoria, conllevando a una lectura excesiva del b\u00fafer en la regi\u00f3n heap de la memoria mientras se ejecuta strchr() comenzando con un puntero despu\u00e9s de un car\u00e1cter \"\\0\" (donde el procesamiento de una cadena fue terminado)."}], "lastModified": "2024-11-21T04:37:52.070", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ezxml_project:ezxml:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "082C3DDB-6357-4E00-9E52-DC9EB99781BF", "versionEndIncluding": "0.8.6", "versionStartIncluding": "0.8.3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}