CVE-2024-50615 Denial of service in n/a

Medium 6.5 Published 27 Oct 2024 Updated 30 Oct 2024

A reachable assertion in TinyXML2 allows attackers to cause application exit via crafted XML input, leading to denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2024-50615?

CVE-2024-50615 is a medium-severity denial of service vulnerability in n/a, published on 27 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.

Weakness: CWE-617

Which versions are affected by CVE-2024-50615?

It affects 1 product.

Linux distribution packages (1)

tinyxml2 openSUSE:Tumbleweed All versions 10.1.0-1.1

Products include Tinyxml2 Project Tinyxml2.

How do I fix CVE-2024-50615?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-50615 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-50615 exists.

Sources

Also known as AZL-51871, AZL-51884, AZL-51888, AZL-51999, AZL-52020, DEBIAN-CVE-2024-50615 and 3 more.