NetSight
IP …
medium5.0

CVE-2014-3660

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent att…

Impact

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.

Affected products

VendorProductAffected versions
XmlsoftLibxml2
through 2.9.1
Versions 2.0.0, 2.1.0, 2.1.1, 2.2.0, 2.2.1
AppleMac Os X
through 10.10.4
CanonicalUbuntu Linux
Versions 10.04, 12.04, 14.04
DebianDebian Linux
Version 7.0
RedhatEnterprise Linux
Version 5.0

References