5

CVE-2011-2205

Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Prosody ≫ Prosody Version <= 0.8.0
Prosody ≫ Prosody Version0.1.0
Prosody ≫ Prosody Version0.2.0
Prosody ≫ Prosody Version0.3.0
Prosody ≫ Prosody Version0.4.0
Prosody ≫ Prosody Version0.4.1
Prosody ≫ Prosody Version0.4.2
Prosody ≫ Prosody Version0.5.0
Prosody ≫ Prosody Version0.5.1
Prosody ≫ Prosody Version0.5.2
Prosody ≫ Prosody Version0.6
Prosody ≫ Prosody Version0.6.0
Prosody ≫ Prosody Version0.6.1
Prosody ≫ Prosody Version0.7
Prosody ≫ Prosody Version0.7.0
Prosody ≫ Prosody Version0.8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.07% 0.79
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://blog.prosody.im/prosody-0-8-1-released/
Patch
http://hg.prosody.im/0.8/rev/5305a665bdd4
Patch
http://hg.prosody.im/0.8/rev/ee6a18f10a8d
Patch
http://prosody.im/doc/release/0.8.1
Patch
http://secunia.com/advisories/44852
Vendor Advisory
http://www.openwall.com/lists/oss-security/2011/06/14/6
http://www.openwall.com/lists/oss-security/2011/06/15/5
http://www.securityfocus.com/bid/48125
https://exchange.xforce.ibmcloud.com/vulnerabilities/67884