CVE-2018-20004: Buffer Overflow

Published Dec 10, 2018

Updated

An issue has been found in Mini-XML (aka mxml) 2.12. It is a stack-based buffer overflow in mxmlwritenode in mxml-file.c via vectors involving a double-precision floating point number and the '<order type="real">' substring, as demonstrated by testmxml.

Affected Software

4 affected components

Mini-xml Project Mini-xml=2.12

Debian Debian Linux=8.0

Fedoraproject Fedora=28

Fedoraproject Fedora=29

Event History

Dec 10, 2018

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2018-20004?

CVE-2018-20004 is classified as a high severity vulnerability due to its potential for exploitation via stack-based buffer overflow.

How do I fix CVE-2018-20004?

To mitigate CVE-2018-20004, upgrade Mini-XML to version 2.12.1 or later, or apply any relevant patches provided by your distribution.

What software is affected by CVE-2018-20004?

CVE-2018-20004 affects Mini-XML version 2.12, as well as Debian 8.0 and Fedora 28 and 29 distributions that use this version.

What type of vulnerability is CVE-2018-20004?

CVE-2018-20004 is a stack-based buffer overflow vulnerability that can occur in the mxml_write_node function.

What are the potential impacts of exploiting CVE-2018-20004?

Exploitation of CVE-2018-20004 could allow an attacker to execute arbitrary code or crash the application, leading to denial of service.