CVE-2015-2942 — XML Entity Expansion in Mediawiki

CWE-3998 documents4 sources
Severity
7.1HIGHNVD
EPSS
1.7%
top 17.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MediawikiDebian Mediawiki
Timeline
PublishedApr 13
Latest updateMay 17

Description

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937.

CVSS vector

AV:N/AC:M/C:N/I:N/A:CExploitability: 8.6 | Impact: 6.9

Affected Packages3 packages

▶debiandebian/mediawiki< mediawiki 1:1.19.20+dfsg-2.3 (bookworm)
▶Debianmediawiki/mediawiki< 1:1.19.20+dfsg-2.3+3
▶NVDmediawiki/mediawiki1.19.23+48

Patches

Patch: lists.wikimedia.org ↗Patch: lists.wikimedia.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-g2xw-jrgp-4j4f: MediaWiki before 1↗2022-05-17
▶
GHSA
GHSA-mmcv-w5m4-3p9m: MediaWiki before 1↗2022-05-17
▶
OSV
CVE-2015-2942: MediaWiki before 1↗2015-04-13
▶
OSV
CVE-2015-2937: MediaWiki before 1↗2015-04-13
▶

📋Vendor Advisories

2
Debian
CVE-2015-2937: mediawiki - MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when usi...↗2015
▶
Debian
CVE-2015-2942: mediawiki - MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when usi...↗2015
▶
CVE-2015-2942 — XML Entity Expansion in Mediawiki | cvebase