CVE-2023-54354
HIGH
8,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH
7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Description
AI Translation Available
Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues.
476
NULL Pointer Dereference
StableCommon Consequences
Security Scopes Affected:
Availability
Integrity
Confidentiality
Potential Impacts:
Dos: Crash, Exit, Or Restart
Execute Unauthorized Code Or Commands
Read Memory
Modify Memory
Applicable Platforms
Languages:
C, C++, Java, C#, Go
https://github.com/sparklemotion/nokogiri/commit/09a2dd453007f9c7205274623acdd7…
https://github.com/sparklemotion/nokogiri/commit/4c6922f763ad958c48ff66f82823ae…
https://github.com/sparklemotion/nokogiri/commit/647e072ea0a2f12687fa05c172f4c4…
https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-pxvg-2qj5-37…
https://www.vulncheck.com/advisories/nokogiri-before-null-pointer-dereference-v…