<story><title>Zoom: Remote Code Execution with XMPP Stanza Smuggling</title><url>https://bugs.chromium.org/p/project-zero/issues/detail?id=2254</url></story><parent_chain></parent_chain><comment><author>twoodfin</author><text>The XML parsing&amp;#x2F;validation bugs are, I suppose, not shocking, but deeply disappointing.&lt;p&gt;The &lt;i&gt;one thing&lt;/i&gt; XML &amp;amp; its tooling were supposed to get right was document well-formed-ness. Sure, it might be a mess of a standard in other ways, but at least we could agree what a parser should and shouldn’t accept! (Not the case for the HTML tag soup of then or now.)&lt;p&gt;That, 25 years on, a popular XML processor can’t even meet that low bar for &lt;i&gt;tag names&lt;/i&gt; is maddening.</text></comment>
<story><title>Zoom: Remote Code Execution with XMPP Stanza Smuggling</title><url>https://bugs.chromium.org/p/project-zero/issues/detail?id=2254</url></story><parent_chain></parent_chain><comment><author>Flowdalic</author><text>It appears that Gloox, a relative low-level XMPP-client C library, rolled much of its Unicode and XML parsing itself, which made such vulnerabilities more likely. There maybe good reasons to not re-use existing modules and rely on external libraries, especially if you target constraint low-end embedded devices, but you should always be aware of the drawbacks. And the Zoom client typically does not run on those.</text></comment>