CVE-2013-1864
published 2014-05-23CVE-2013-1864: The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows…
PriorityP423medium4.3CVSS 2.0
AVNACMAuNCNINAP
EPSS
2.85%
85.1th percentile
The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references, aka a "billion laughs attack."
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ekiga | ekiga | <= 4.0.0 | — |
| opalvoip | portable_tool_library | — | — |
| opalvoip | portable_tool_library | — | — |
| opalvoip | portable_tool_library | — | — |
| opalvoip | portable_tool_library | — | — |
| suse | suse_linux_enterprise_desktop | — | — |
| suse | suse_linux_enterprise_software_development_kit | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ptlib: denial of service processing certain XML documents
vendor_redhat·2013-01-09·CVSS 4.3
CVE-2013-1864 [MEDIUM] ptlib: denial of service processing certain XML documents
ptlib: denial of service processing certain XML documents
The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references, aka a "billion laughs attack."
Package: pwlib (Red Hat Enterprise Linux 5) - Will not fix
Package: ptlib (Red Hat Enterprise Linux 6) - Will not fix
GHSA
GHSA-4hmc-wjwv-5gj5: The Portable Tool Library (aka PTLib) before 2
ghsa_unreviewed·2022-05-17
CVE-2013-1864 [MEDIUM] CWE-119 GHSA-4hmc-wjwv-5gj5: The Portable Tool Library (aka PTLib) before 2
The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references, aka a "billion laughs attack."
No detection rules found.
No public exploits indexed.
http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099553.htmlhttp://osvdb.org/91439http://seclists.org/oss-sec/2013/q1/674http://secunia.com/advisories/52659http://sourceforge.net/p/opalvoip/code/28856http://www.ekiga.org/news/2013-02-21/ekiga-4.0.1-stable-availablehttp://www.securityfocus.com/bid/58520https://exchange.xforce.ibmcloud.com/vulnerabilities/82885https://www.suse.com/support/update/announcement/2014/suse-su-20140237-1.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-March/099553.htmlhttp://osvdb.org/91439http://seclists.org/oss-sec/2013/q1/674http://secunia.com/advisories/52659http://sourceforge.net/p/opalvoip/code/28856http://www.ekiga.org/news/2013-02-21/ekiga-4.0.1-stable-availablehttp://www.securityfocus.com/bid/58520https://exchange.xforce.ibmcloud.com/vulnerabilities/82885https://www.suse.com/support/update/announcement/2014/suse-su-20140237-1.html
2014-05-23
Published