CVE-2023-34194

Published: Dec 13, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a crafted XML document with a '\0' located after whitespace.

Affected (1)

Products: Tinyxml Project: Tinyxml

Tinyxml Project

1 product

Tinyxml

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tinyxml Project Tinyxml	Up to 2.6.2

Related CWEs

CWE-617

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (12)

https://lists.debian.org/debian-lts-announce/2023/12/msg00024.html

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOMBSHRIW5Q34SQSXYURYAOYDZD2NQF6/

Source: cve@mitre.org

https://sourceforge.net/p/tinyxml/git/ci/master/tree/tinyxmlparser.cpp

Source: cve@mitre.org

Patch

https://www.forescout.com/resources/sierra21-vulnerabilities

Source: cve@mitre.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2023/12/msg00024.html