cbcvebase.
CVE-2014-3660
published 2014-11-04

CVE-2014-3660: parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent…

medium5CVSS 3.1
AVNACLAuNCNINAP
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.

Affected

147 ranges· showing 25
VendorProductVersion rangeFixed in
appleapple_tv
appleios
appleiphone_os<= 9.2.1
applemac_os_x<= 10.10.4
applemac_os_x<= 10.11.3
appleos_x_yosemite_v10.10.5_and_security_update_2015-006
appletvos<= 9.1
applewatchos<= 2.1
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debiandebian_linux
debianlibxml2< libxml2 2.9.3+dfsg1-1 (bookworm)libxml2 2.9.3+dfsg1-1 (bookworm)
debianlibxml2< libxml2 2.9.2+dfsg1-1 (bookworm)libxml2 2.9.2+dfsg1-1 (bookworm)
hpicewall_federation_agent
hpicewall_file_manager
nokogirinokogiri>= 1.6.0 < 1.6.7.11.6.7.1
redhatenterprise_linux
redhatenterprise_linux_desktop
redhatenterprise_linux_hpc_node
redhatenterprise_linux_server
redhatenterprise_linux_workstation

CVSS provenance

nvd7.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
ghsa5.0MEDIUM
osv5.0MEDIUM