NVD

Id
31811  
Name
CVE-2014-3660  
Description
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-19  
Published
2014-11-04  
Modified Date
2016-12-07  
Seq
2014-3660  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
167673 31811 CVE-2014-3660 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705  View
167674 31811 CVE-2014-3660 APPLE-SA-2015-08-13-2  View
167675 31811 CVE-2014-3660 APPLE-SA-2015-08-13-3  View
167676 31811 CVE-2014-3660 openSUSE-SU-2014:1330  View
167677 31811 CVE-2014-3660 openSUSE-SU-2015:2372  View
167678 31811 CVE-2014-3660 RHSA-2014:1655  View
167679 31811 CVE-2014-3660 RHSA-2014:1885  View
167680 31811 CVE-2014-3660 DSA-3057  View
167681 31811 CVE-2014-3660 MDVSA-2014:244  View
167682 31811 CVE-2014-3660 [oss-security] 20141017 libxml2 issue: billioun laughs variant (CVE-2014-3660)  View
167683 31811 CVE-2014-3660 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html  View
167684 31811 CVE-2014-3660 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html  View
167685 31811 CVE-2014-3660 70644  View
167686 31811 CVE-2014-3660 USN-2389-1  View
167687 31811 CVE-2014-3660 https://bugzilla.redhat.com/attachment.cgi?id=944444&action=diff  View
167688 31811 CVE-2014-3660 https://bugzilla.redhat.com/show_bug.cgi?id=1149084  View
167689 31811 CVE-2014-3660 https://support.apple.com/kb/HT205030  View
167690 31811 CVE-2014-3660 https://support.apple.com/kb/HT205031  View
167691 31811 CVE-2014-3660 https://www.ncsc.nl/actueel/nieuwsberichten/kwetsbaarheid-ontdekt-in-libxml2.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
16353 JVNDB-2014-005228 libxml2 の parser.c におけるサービス運用妨害 (DoS) の脆弱性 libxml2 の parser.c は、エンティティの置き換えが無効な場合でもエンティティの拡張を適切に制限しないため、サービス運用妨害 (CPU 資源の消費) 状態にされる脆弱性が存在します。 CVE-2014-3660 70948 CVE-2014-3660 31811 5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005228.html 2014-10-07 2015-08-31 View