Vulnerability · Published Dec 25, 2022 · Assigned by VulDB
CVE-2022-4741docconv XMLToText memory allocation
Medium 4.3
In plain English
A medium-severity security flaw in docconv. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText. The manipulation leads to uncontrolled memory allocation. The attack may be initiated remotely. Upgrading to version 1.2.1 is able to address this issue. The name of the patch is 42bcff666855ab978e67a9041d0cdea552f20301. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216779.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | code.sajari.com/docconv | 1.2.1 | GHSA-qvx2-59g8-8hph |
| Go | code.sajari.com/docconv | 1.2.1 | GO-2022-1188 |
| Go | github.com/sajari/docconv | 1.2.1 | GHSA-qvx2-59g8-8hph |
Affected products (as reported)
Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
References
- https://vuldb.com/?id.216779 vdb-entry, technical-description
- https://vuldb.com/?ctiid.216779 signature, permissions-required
- https://github.com/sajari/docconv/pull/111 issue-tracking
- https://github.com/sajari/docconv/commit/42bcff666855ab978e67a9041d0cdea552f20301 patch
- https://github.com/sajari/docconv/releases/tag/v1.2.1 patch