CVE

Id
49665  
CVE No.
CVE-2011-1753  
Status
Candidate  
Description
expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.  
Phase
Assigned (20110419)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
539330 49665 CVE-2011-1753 CONFIRM:http://www.ejabberd.im/ejabberd-2.1.7  View
539331 49665 CVE-2011-1753 CONFIRM:http://www.process-one.net/en/ejabberd/release_notes/release_note_ejabberd_2.1.7/  View
539332 49665 CVE-2011-1753 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=700454  View
539333 49665 CVE-2011-1753 CONFIRM:https://git.process-one.net/ejabberd/mainline/commit/bd1df027c622e1f96f9eeaac612a6a956c1ff0b6  View
539334 49665 CVE-2011-1753 DEBIAN:DSA-2248  View
539335 49665 CVE-2011-1753 URL:http://www.debian.org/security/2011/dsa-2248  View
539336 49665 CVE-2011-1753 FEDORA:FEDORA-2011-8415  View
539337 49665 CVE-2011-1753 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062099.html  View
539338 49665 CVE-2011-1753 FEDORA:FEDORA-2011-8437  View
539339 49665 CVE-2011-1753 URL:http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062145.html  View
539340 49665 CVE-2011-1753 BID:48072  View
539341 49665 CVE-2011-1753 URL:http://www.securityfocus.com/bid/48072  View
539342 49665 CVE-2011-1753 SECUNIA:44765  View
539343 49665 CVE-2011-1753 URL:http://secunia.com/advisories/44765  View
539344 49665 CVE-2011-1753 SECUNIA:44807  View
539345 49665 CVE-2011-1753 URL:http://secunia.com/advisories/44807  View
539346 49665 CVE-2011-1753 SECUNIA:45120  View
539347 49665 CVE-2011-1753 URL:http://secunia.com/advisories/45120  View
539348 49665 CVE-2011-1753 XF:ejabberd-xml-dos(67769)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
34302 JVNDB-2011-004544 SSSD の krb5_save_ccname_done 関数におけるケルベロス認証を回避される脆弱性 System Security Services Daemon (SSSD) の providers/krb5/krb5_auth.c の krb5_save_ccname_done 関数は、自動チケット更新およびオフライン認証が設定される際、パスワードとしてパス名文字列を使うため、ケルベロス認証を回避される脆弱性が存在します。 CVE-2011-1758 49665 3.7 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004544.html  View