TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-763ac380b6 advisory.

  - TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the     TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.
    (CVE-2021-42260)

  - StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable     assertion (and application exit) via a crafted XML document with a '\0' located after whitespace.
    (CVE-2023-34194)

  - The ACEManager component of ALEOS 4.16 and earlier does not perform input sanitization during     authentication, which could potentially result in a Denial of Service (DoS) condition for ACEManager     without impairing other router functions. ACEManager recovers from the DoS condition by restarting within     ten seconds of becoming unavailable. (CVE-2023-40462)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c9dc0ac419 advisory.

  - TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the     TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.
    (CVE-2021-42260)

  - StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable     assertion (and application exit) via a crafted XML document with a '\0' located after whitespace.
    (CVE-2023-34194)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-80e6578a01 advisory.

  - TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the     TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.
    (CVE-2021-42260)

  - StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable     assertion (and application exit) via a crafted XML document with a '\0' located after whitespace.
    (CVE-2023-34194)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6542-1 advisory.

  - TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the     TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.
    (CVE-2021-42260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3130 advisory.

  - TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the     TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.
    (CVE-2021-42260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2988 advisory.

  - TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the     TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.
    (CVE-2021-42260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1474-1 advisory.

  - TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the     TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.
    (CVE-2021-42260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:3639-1 advisory.

  - TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the     TIXML_UTF_LEAD_0 case. It can be triggered by a crafted XML message and leads to a denial of service.
    (CVE-2021-42260)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194679	Fedora 40 : tinyxml (2024-763ac380b6)	Nessus	Fedora Local Security Checks	high
187965	Fedora 38 : tinyxml (2024-c9dc0ac419)	Nessus	Fedora Local Security Checks	high
187673	Fedora 39 : tinyxml (2024-80e6578a01)	Nessus	Fedora Local Security Checks	high
186682	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS : TinyXML vulnerability (USN-6542-1)	Nessus	Ubuntu Local Security Checks	high
165647	Debian DLA-3130-1 : tinyxml - LTS security update	Nessus	Debian Local Security Checks	high
160409	Debian DLA-2988-1 : tinyxml - LTS security update	Nessus	Debian Local Security Checks	high
155355	openSUSE 15 Security Update : tinyxml (openSUSE-SU-2021:1474-1)	Nessus	SuSE Local Security Checks	high
155010	openSUSE 15 Security Update : tinyxml (openSUSE-SU-2021:3639-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-42260

high

Tenable Plugins

high

high

high

high

high

high

high

high