cbcvebase.
CVE-2015-2942
published 2015-04-13

CVE-2015-2942: MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory…

PriorityP427high7.1CVSS 2.0
AVNACMAuNCNINAC
EPSS
2.81%
85.1th percentile
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937.

Affected

54 ranges· showing 25
VendorProductVersion rangeFixed in
debianmediawiki< mediawiki 1:1.19.20+dfsg-2.3 (bookworm)mediawiki 1:1.19.20+dfsg-2.3 (bookworm)
mediawikimediawiki<= 1.19.23—
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——
mediawikimediawiki——

CVSS provenance

nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
osv7.1HIGH
vendor_debian7.1LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.