CVE-2024-34393: libxmljs2 Type Confusion Vulnerability
Summary
CVE-2024-34393: libxmljs2 type confusion vulnerability when parsing specially crafted XML. Affects libxmljs2 versions < 0.33.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libxmljs2 is an npm package that provides a Node.js interface to the libxml2 library, allowing developers to parse and manipulate XML documents. It is widely used in various applications for XML processing. However, a vulnerability has been discovered in libxmljs2 that can lead to type confusion when parsing specially crafted XML. This vulnerability affects versions 0.0.1 to 0.33.0 of the package.
Vulnerability Detail
The type confusion vulnerability in libxmljs2 occurs when a function is invoked on the result of attrs() that was called on a parsed node. This can be exploited by an attacker by providing specially crafted XML input. The impact of this vulnerability can be severe, including denial of service on both 32-bit and 64-bit systems, data leakage, infinite loops, and even remote code execution on 32-bit systems with the XML_PARSE_HUGE flag enabled. As of now, there is no available fix for this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section and update the package as soon as a fix becomes available.
Conclusion
The libxmljs2 package is vulnerable to a type confusion vulnerability when parsing specially crafted XML. This vulnerability can have severe consequences, including denial of service, data leakage, and remote code execution. It is crucial to stay updated with the latest version of the package and validate XML input to mitigate the risk. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libxmljs2 →
FAQ
libxmljs2 is an npm package that provides a Node.js interface to the libxml2 library, enabling developers to parse and manipulate XML documents.
The impact of this vulnerability can be severe, including denial of service, data leakage, infinite loops, and remote code execution on certain systems.
Versions 0.0.1 to 0.33.0 of the libxmljs2 package are affected by this vulnerability.
As of now, there is no fix available for this vulnerability. It is recommended to update the package once a fix is released.
Currently, there are no known workarounds for this vulnerability. Updating the package is the recommended course of action.
Related vulnerabilities
Recent vulnerabilities recorded for libxmljs2.
