5

CVE-2014-3660

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.

Data is provided by the National Vulnerability Database (NVD)
Xmlsoft ≫ Libxml2 Version <= 2.9.1
Xmlsoft ≫ Libxml2 Version2.0.0
Xmlsoft ≫ Libxml2 Version2.1.0
Xmlsoft ≫ Libxml2 Version2.1.1
Xmlsoft ≫ Libxml2 Version2.2.0
Xmlsoft ≫ Libxml2 Version2.2.0 Updatebeta
Xmlsoft ≫ Libxml2 Version2.2.1
Xmlsoft ≫ Libxml2 Version2.2.2
Xmlsoft ≫ Libxml2 Version2.2.3
Xmlsoft ≫ Libxml2 Version2.2.4
Xmlsoft ≫ Libxml2 Version2.2.5
Xmlsoft ≫ Libxml2 Version2.2.6
Xmlsoft ≫ Libxml2 Version2.2.7
Xmlsoft ≫ Libxml2 Version2.2.8
Xmlsoft ≫ Libxml2 Version2.2.9
Xmlsoft ≫ Libxml2 Version2.2.10
Xmlsoft ≫ Libxml2 Version2.2.11
Xmlsoft ≫ Libxml2 Version2.3.0
Xmlsoft ≫ Libxml2 Version2.3.1
Xmlsoft ≫ Libxml2 Version2.3.2
Xmlsoft ≫ Libxml2 Version2.3.3
Xmlsoft ≫ Libxml2 Version2.3.4
Xmlsoft ≫ Libxml2 Version2.3.5
Xmlsoft ≫ Libxml2 Version2.3.6
Xmlsoft ≫ Libxml2 Version2.3.7
Xmlsoft ≫ Libxml2 Version2.3.8
Xmlsoft ≫ Libxml2 Version2.3.9
Xmlsoft ≫ Libxml2 Version2.3.10
Xmlsoft ≫ Libxml2 Version2.3.11
Xmlsoft ≫ Libxml2 Version2.3.12
Xmlsoft ≫ Libxml2 Version2.3.13
Xmlsoft ≫ Libxml2 Version2.3.14
Xmlsoft ≫ Libxml2 Version2.4.1
Xmlsoft ≫ Libxml2 Version2.4.2
Xmlsoft ≫ Libxml2 Version2.4.3
Xmlsoft ≫ Libxml2 Version2.4.4
Xmlsoft ≫ Libxml2 Version2.4.5
Xmlsoft ≫ Libxml2 Version2.4.6
Xmlsoft ≫ Libxml2 Version2.4.7
Xmlsoft ≫ Libxml2 Version2.4.8
Xmlsoft ≫ Libxml2 Version2.4.9
Xmlsoft ≫ Libxml2 Version2.4.10
Xmlsoft ≫ Libxml2 Version2.4.11
Xmlsoft ≫ Libxml2 Version2.4.12
Xmlsoft ≫ Libxml2 Version2.4.13
Xmlsoft ≫ Libxml2 Version2.4.14
Xmlsoft ≫ Libxml2 Version2.4.15
Xmlsoft ≫ Libxml2 Version2.4.16
Xmlsoft ≫ Libxml2 Version2.4.17
Xmlsoft ≫ Libxml2 Version2.4.18
Xmlsoft ≫ Libxml2 Version2.4.19
Xmlsoft ≫ Libxml2 Version2.4.20
Xmlsoft ≫ Libxml2 Version2.4.21
Xmlsoft ≫ Libxml2 Version2.4.22
Xmlsoft ≫ Libxml2 Version2.4.23
Xmlsoft ≫ Libxml2 Version2.4.24
Xmlsoft ≫ Libxml2 Version2.4.25
Xmlsoft ≫ Libxml2 Version2.4.26
Xmlsoft ≫ Libxml2 Version2.4.27
Xmlsoft ≫ Libxml2 Version2.4.28
Xmlsoft ≫ Libxml2 Version2.4.29
Xmlsoft ≫ Libxml2 Version2.4.30
Xmlsoft ≫ Libxml2 Version2.5.0
Xmlsoft ≫ Libxml2 Version2.5.4
Xmlsoft ≫ Libxml2 Version2.5.7
Xmlsoft ≫ Libxml2 Version2.5.8
Xmlsoft ≫ Libxml2 Version2.5.10
Xmlsoft ≫ Libxml2 Version2.5.11
Xmlsoft ≫ Libxml2 Version2.6.0
Xmlsoft ≫ Libxml2 Version2.6.1
Xmlsoft ≫ Libxml2 Version2.6.2
Xmlsoft ≫ Libxml2 Version2.6.3
Xmlsoft ≫ Libxml2 Version2.6.4
Xmlsoft ≫ Libxml2 Version2.6.5
Xmlsoft ≫ Libxml2 Version2.6.6
Xmlsoft ≫ Libxml2 Version2.6.7
Xmlsoft ≫ Libxml2 Version2.6.8
Xmlsoft ≫ Libxml2 Version2.6.9
Xmlsoft ≫ Libxml2 Version2.6.11
Xmlsoft ≫ Libxml2 Version2.6.12
Xmlsoft ≫ Libxml2 Version2.6.13
Xmlsoft ≫ Libxml2 Version2.6.14
Xmlsoft ≫ Libxml2 Version2.6.16
Xmlsoft ≫ Libxml2 Version2.6.17
Xmlsoft ≫ Libxml2 Version2.6.18
Xmlsoft ≫ Libxml2 Version2.6.20
Xmlsoft ≫ Libxml2 Version2.6.21
Xmlsoft ≫ Libxml2 Version2.6.22
Xmlsoft ≫ Libxml2 Version2.6.23
Xmlsoft ≫ Libxml2 Version2.6.24
Xmlsoft ≫ Libxml2 Version2.6.25
Xmlsoft ≫ Libxml2 Version2.6.26
Xmlsoft ≫ Libxml2 Version2.6.27
Xmlsoft ≫ Libxml2 Version2.6.28
Xmlsoft ≫ Libxml2 Version2.6.29
Xmlsoft ≫ Libxml2 Version2.6.30
Xmlsoft ≫ Libxml2 Version2.6.31
Xmlsoft ≫ Libxml2 Version2.6.32
Xmlsoft ≫ Libxml2 Version2.7.0
Xmlsoft ≫ Libxml2 Version2.7.1
Xmlsoft ≫ Libxml2 Version2.7.2
Xmlsoft ≫ Libxml2 Version2.7.3
Xmlsoft ≫ Libxml2 Version2.7.4
Xmlsoft ≫ Libxml2 Version2.7.5
Xmlsoft ≫ Libxml2 Version2.7.6
Xmlsoft ≫ Libxml2 Version2.7.7
Xmlsoft ≫ Libxml2 Version2.7.8
Xmlsoft ≫ Libxml2 Version2.8.0
Xmlsoft ≫ Libxml2 Version2.9.0
Xmlsoft ≫ Libxml2 Version2.9.0 Updaterc1
Apple ≫ macOS X Version <= 10.10.4
Canonical ≫ Ubuntu Linux Version10.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version12.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Debian ≫ Debian Linux Version7.0
Redhat ≫ Enterprise Linux Version5.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 5.38% 0.897
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P