CVE-2013-0338
MEDIUM severity · CVSS 4.3 · Memory corruption
4.3CVSS MEDIUM
Summary
libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.
Impact & exploitability
Attack vectorNetwork
Attack complexity—
Privileges required—
User interaction—
Confidentiality impactNone
Integrity impactNone
Availability impact—
Exploit probability (EPSS)3%
AV:N/AC:M/Au:N/C:N/I:N/A:P
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00112.html
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00114.html
- http://marc.info/?l=bugtraq&m=142798889927587&w=2
- http://secunia.com/advisories/52662
- http://secunia.com/advisories/55568
- http://www.debian.org/security/2013/dsa-2652
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:056