NVD

Id
30080  
Name
CVE-2014-1439  
Description
The libxml_disable_entity_loader function in runtime/ext/ext_simplexml.cpp in HipHop Virtual Machine for PHP (HHVM) before 2.4.0 and 2.3.x before 2.3.3 does not properly disable a certain libxml handler, which allows remote attackers to conduct XML External Entity (XXE) attacks.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2014-02-05  
Modified Date
2014-02-21  
Seq
2014-1439  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
158336 30080 CVE-2014-1439 http://www.hhvm.com/blog/3287/hhvm-2-4-0  View
158337 30080 CVE-2014-1439 hhvm-cve20141439-info-disc(90979)  View
158338 30080 CVE-2014-1439 https://github.com/facebook/hhvm/commit/95f96e7287effe2fcdfb9a5338d1a7e4f55b083b  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
12458 JVNDB-2014-001333 HipHop Virtual Machine for PHP における XML 外部エンティティ (XXE) 攻撃を実行される脆弱性 HipHop Virtual Machine for PHP (HHVM) の runtime/ext/ext_simplexml.cpp 内の libxml_disable_entity_loader 関数は、特定の libxml ハンドラを適切に無効にしないため、XML 外部エンティティ (XXE) 攻撃を実行される脆弱性が存在します。 CVE-2014-1439 68726 CVE-2014-1439 30080 5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001333.html 2014-02-01 2014-02-07 View