NVD

Id
36685  
Name
CVE-2013-0339  
Description
libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2014-01-21  
Modified Date
2016-05-05  
Seq
2013-0339  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
187491 36685 CVE-2013-0339 SUSE-SU-2013:1627  View
187492 36685 CVE-2013-0339 [oss-security] 20130221 CVE Guidance for Libraries and Resource-Consumption DoS  View
187493 36685 CVE-2013-0339 [oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion  View
187494 36685 CVE-2013-0339 [oss-security] 20131028 Re: CVE Request: libxml2 external parsed entities issue  View
187495 36685 CVE-2013-0339 [oss-security] 20131029 Re: CVE Request: libxml2 external parsed entities issue  View
187496 36685 CVE-2013-0339 [oss-security] 20131029 Re: CVE Request: libxml2 external parsed entities issue  View
187497 36685 CVE-2013-0339 DSA-2652  View
187498 36685 CVE-2013-0339 [oss-security] 20130412 Re-evaluating expat/libxml2 CVE assignments  View
187499 36685 CVE-2013-0339 USN-1904-1  View
187500 36685 CVE-2013-0339 USN-1904-2  View
187501 36685 CVE-2013-0339 https://bugzilla.redhat.com/show_bug.cgi?id=915149  View
187502 36685 CVE-2013-0339 https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
24300 JVNDB-2013-005875 libxml2 におけるサービス運用妨害 (DoS) の脆弱性 libxml2 は、アプリケーション開発者が xmlSAX2ResolveEntity または xmlSetExternalEntityLoader 関数を使用していない場合、外部エンティティ拡張を適切に処理しないため、サービス運用妨害 (リソース消費) 状態にされる、イントラネットサーバに HTTP リクエストを送信される、または任意のファイルを読まれる脆弱性が存在します。 CVE-2013-0339 60281 CVE-2013-0339 36685 6.8 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005875.html 2013-02-25 2014-01-23 View