CVE-2021-31347

Name of the Vulnerable Software and Affected Versions ezXML version 0.8.6

Description The issue is related to incorrect memory handling by the ezxml parse str() function when parsing crafted XML files, which can lead to writing outside a memory region created by mmap. Additionally, the vulnerability is associated with blind XPath injection, allowing a remote attacker to cause a denial of service using a specially crafted XML file.

Recommendations For ezXML version 0.8.6, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the ezxml parse str() function until a patch is available. Restrict access to the libezxml.a library to minimize the risk of exploitation. Avoid using the ezxml parse str() function with untrusted XML files until the issue is resolved.