CVE-2021-42260 - Vulnerability Details - OpenCVE

ReportizFlow

TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

AV:N/AC:L/Au:N/C:N/I:N/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Debian	Debian Linux
Tinyxml Project	Tinyxml

Configuration 1 [-]

OR	cpe:2.3:a:tinyxml_project:tinyxml::::::::
	cpe:2.3:a:tinyxml_project:tinyxml:2.3.0:beta::::::
	cpe:2.3:a:tinyxml_project:tinyxml:2.3.1:beta::::::

Configuration 2 [-]

OR	cpe:2.3:o:debian:debian_linux:9.0:::::::*
	cpe:2.3:o:debian:debian_linux:10.0:::::::*

No data.

References

Link	Providers
https://lists.debian.org/debian-lts-announce/2022/04/msg00019.html
https://lists.debian.org/debian-lts-announce/2022/09/msg00041.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOMBSHRIW5Q34SQSXYURYAOYDZD2NQF6/
https://sourceforge.net/p/tinyxml/bugs/141/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-10-11T00:00:00

Updated: 2024-08-04T03:30:37.752Z

Reserved: 2021-10-11T00:00:00

Link: CVE-2021-42260

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-10-11T20:15:07.433

Modified: 2024-11-21T06:27:28.440

Link: CVE-2021-42260

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-42260", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-04T03:30:37.752Z", "dateReserved": "2021-10-11T00:00:00", "datePublished": "2021-10-11T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-01-12T02:06:21.004380"}, "descriptions": [{"lang": "en", "value": "TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://sourceforge.net/p/tinyxml/bugs/141/"}, {"name": "[debian-lts-announce] 20220430 [SECURITY] [DLA 2988-1] tinyxml security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00019.html"}, {"name": "[debian-lts-announce] 20220930 [SECURITY] [DLA 3130-1] tinyxml security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00041.html"}, {"name": "FEDORA-2024-80e6578a01", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE/"}, {"name": "FEDORA-2024-c9dc0ac419", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOMBSHRIW5Q34SQSXYURYAOYDZD2NQF6/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:30:37.752Z"}, "title": "CVE Program Container", "references": [{"url": "https://sourceforge.net/p/tinyxml/bugs/141/", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20220430 [SECURITY] [DLA 2988-1] tinyxml security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00019.html"}, {"name": "[debian-lts-announce] 20220930 [SECURITY] [DLA 3130-1] tinyxml security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00041.html"}, {"name": "FEDORA-2024-80e6578a01", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE/"}, {"name": "FEDORA-2024-c9dc0ac419", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOMBSHRIW5Q34SQSXYURYAOYDZD2NQF6/"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tinyxml_project:tinyxml:*:*:*:*:*:*:*:*", "matchCriteriaId": "9CE02F0C-889F-497F-A9F2-9F3129145ED5", "versionEndIncluding": "2.6.2", "versionStartIncluding": "2.3.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:tinyxml_project:tinyxml:2.3.0:beta:*:*:*:*:*:*", "matchCriteriaId": "A870DC76-AAB7-4571-A6EE-294FC0E4B919", "vulnerable": true}, {"criteria": "cpe:2.3:a:tinyxml_project:tinyxml:2.3.1:beta:*:*:*:*:*:*", "matchCriteriaId": "DAE75FD3-7682-40A3-92EF-BE6EBF157691", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service."}, {"lang": "es", "value": "TinyXML versiones hasta 2.6.2, presenta un bucle infinito en la funci\u00f3n TiXmlParsingData::Stamp en el archivo tinyxmlparser.cpp por medio del caso TIXML_UTF_LEAD_0. Puede ser activado por un mensaje XML dise\u00f1ado y conlleva una denegaci\u00f3n de servicio"}], "id": "CVE-2021-42260", "lastModified": "2024-11-21T06:27:28.440", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2021-10-11T20:15:07.433", "references": [{"source": "[email protected]", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00019.html"}, {"source": "[email protected]", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00041.html"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOMBSHRIW5Q34SQSXYURYAOYDZD2NQF6/"}, {"source": "[email protected]", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://sourceforge.net/p/tinyxml/bugs/141/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00019.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00041.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QCR5PIOBGDIDS6SYRESTMDJSEDFSCOE/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HOMBSHRIW5Q34SQSXYURYAOYDZD2NQF6/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://sourceforge.net/p/tinyxml/bugs/141/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "[email protected]", "type": "Primary"}]}