CVE-2019-1010232

Name of the Vulnerable Software and Affected Versions juniper/libslax version (as of commit 084ddf6ab4a55b59dfa9a53f9c5f14d192c4f8e5)

Description The issue is related to a buffer overflow in the slaxGetInput function, located in the slaxlexer.c component. This can be exploited to cause a remote denial of service. The attack vector involves using the ./slaxproc command with the --slax-to-xslt option and a proof-of-concept file, such as POC0. The vulnerability allows a remote attacker to cause a denial of service.

Recommendations For juniper/libslax version (as of commit 084ddf6ab4a55b59dfa9a53f9c5f14d192c4f8e5), consider disabling the slaxGetInput function in the slaxlexer.c component as a temporary workaround to minimize the risk of exploitation. Avoid using the ./slaxproc command with the --slax-to-xslt option until the issue is resolved.