An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_char_content() tries to use realloc on a block that was not allocated, leading to an invalid free and segmentation fault.
Weakness
The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ezxml | Ezxml_project | 0.8.3 (including) | 0.8.6 (including) |
| Mapcache | Ubuntu | bionic | * |
| Mapcache | Ubuntu | devel | * |
| Mapcache | Ubuntu | esm-apps/bionic | * |
| Mapcache | Ubuntu | esm-apps/focal | * |
| Mapcache | Ubuntu | esm-apps/jammy | * |
| Mapcache | Ubuntu | esm-apps/noble | * |
| Mapcache | Ubuntu | esm-apps/xenial | * |
| Mapcache | Ubuntu | focal | * |
| Mapcache | Ubuntu | hirsute | * |
| Mapcache | Ubuntu | impish | * |
| Mapcache | Ubuntu | jammy | * |
| Mapcache | Ubuntu | kinetic | * |
| Mapcache | Ubuntu | lunar | * |
| Mapcache | Ubuntu | mantic | * |
| Mapcache | Ubuntu | noble | * |
| Mapcache | Ubuntu | oracular | * |
| Mapcache | Ubuntu | plucky | * |
| Mapcache | Ubuntu | questing | * |
| Mapcache | Ubuntu | trusty | * |
| Mapcache | Ubuntu | upstream | * |
| Mapcache | Ubuntu | xenial | * |
| Navit | Ubuntu | bionic | * |
| Navit | Ubuntu | focal | * |
| Navit | Ubuntu | hirsute | * |
| Navit | Ubuntu | impish | * |
| Navit | Ubuntu | kinetic | * |
| Navit | Ubuntu | lunar | * |
| Navit | Ubuntu | mantic | * |
| Navit | Ubuntu | oracular | * |
| Navit | Ubuntu | plucky | * |
| Navit | Ubuntu | trusty | * |
| Navit | Ubuntu | xenial | * |
| Netcdf | Ubuntu | bionic | * |
| Netcdf | Ubuntu | esm-apps/focal | * |
| Netcdf | Ubuntu | esm-apps/jammy | * |
| Netcdf | Ubuntu | focal | * |
| Netcdf | Ubuntu | hirsute | * |
| Netcdf | Ubuntu | impish | * |
| Netcdf | Ubuntu | jammy | * |
| Netcdf | Ubuntu | kinetic | * |
| Netcdf | Ubuntu | lunar | * |
| Netcdf | Ubuntu | mantic | * |
| Netcdf | Ubuntu | trusty | * |
| Netcdf | Ubuntu | trusty/esm | * |
| Netcdf | Ubuntu | upstream | * |
| Netcdf | Ubuntu | xenial | * |
| Netcdf-parallel | Ubuntu | esm-apps/focal | * |
| Netcdf-parallel | Ubuntu | esm-apps/jammy | * |
| Netcdf-parallel | Ubuntu | focal | * |
| Netcdf-parallel | Ubuntu | hirsute | * |
| Netcdf-parallel | Ubuntu | impish | * |
| Netcdf-parallel | Ubuntu | jammy | * |
| Netcdf-parallel | Ubuntu | kinetic | * |
| Netcdf-parallel | Ubuntu | lunar | * |
| Netcdf-parallel | Ubuntu | mantic | * |
| Netcdf-parallel | Ubuntu | oracular | * |
| Netcdf-parallel | Ubuntu | trusty | * |
| Netcdf-parallel | Ubuntu | upstream | * |
| Netcdf-parallel | Ubuntu | xenial | * |
| Scilab | Ubuntu | bionic | * |
| Scilab | Ubuntu | devel | * |
| Scilab | Ubuntu | esm-apps/bionic | * |
| Scilab | Ubuntu | esm-apps/focal | * |
| Scilab | Ubuntu | esm-apps/jammy | * |
| Scilab | Ubuntu | esm-apps/noble | * |
| Scilab | Ubuntu | focal | * |
| Scilab | Ubuntu | hirsute | * |
| Scilab | Ubuntu | impish | * |
| Scilab | Ubuntu | jammy | * |
| Scilab | Ubuntu | kinetic | * |
| Scilab | Ubuntu | lunar | * |
| Scilab | Ubuntu | mantic | * |
| Scilab | Ubuntu | noble | * |
| Scilab | Ubuntu | oracular | * |
| Scilab | Ubuntu | plucky | * |
| Scilab | Ubuntu | questing | * |
| Scilab | Ubuntu | trusty | * |
| Scilab | Ubuntu | xenial | * |
Extended Description
This weakness can take several forms, such as:
Potential Mitigations
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, glibc in Linux provides protection against free of invalid pointers.