Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2013-0339 | First vendor Publication | 2014-01-21 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0339 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-264 | Permissions, Privileges, and Access Controls |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:20018 | |||
| Oval ID: | oval:org.mitre.oval:def:20018 | ||
| Title: | DSA-2652-1 libxml2 - external entity expansion | ||
| Description: | Brad Hill of iSEC Partners discovered that many XML implementations are vulnerable to external entity expansion issues, which can be used for various purposes such as firewall circumvention, disguising an IP address, and denial-of-service. libxml2 was susceptible to these problems when performing string substitution during entity expansion. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2652-1 CVE-2013-0338 CVE-2013-0339 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | libxml2 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25714 | |||
| Oval ID: | oval:org.mitre.oval:def:25714 | ||
| Title: | SUSE-SU-2013:1625-1 -- Security update for libxml2 | ||
| Description: | This is a LTSS rollup update for the libxml2 library that fixes various security issues. | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2013:1625-1 CVE-2013-2877 CVE-2013-0338 CVE-2012-5134 CVE-2012-2807 CVE-2011-3102 CVE-2012-0841 CVE-2011-3919 CVE-2013-0339 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 10 | Product(s): | libxml2 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25816 | |||
| Oval ID: | oval:org.mitre.oval:def:25816 | ||
| Title: | SUSE-SU-2013:0743-1 -- Security update for libxml2 | ||
| Description: | libxml2 has been updated to fix two security bugs. * CVE-2013-0338: Internal entity expansion within XML was not bounded, leading to simple small XML files being able to cause "out of memory" denial of service conditions. * CVE-2012-5134: Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 allowed remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document. | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2013:0743-1 CVE-2013-0338 CVE-2012-5134 CVE-2013-0339 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 | Product(s): | libxml2 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:25923 | |||
| Oval ID: | oval:org.mitre.oval:def:25923 | ||
| Title: | SUSE-SU-2013:0744-1 -- Security update for libxml2 | ||
| Description: | libxml2 has been updated to fix entity expansion problems: * CVE-2013-0338: Internal entity expansion within XML was not bounded, leading to simple small XML files being able to cause "out of memory" denial of service conditions. | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2013:0744-1 CVE-2013-0338 CVE-2013-0339 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 SUSE Linux Enterprise Desktop 10 | Product(s): | libxml2 |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-05-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2013-1627-1.nasl - Type : ACT_GATHER_INFO |
| 2014-12-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-11.nasl - Type : ACT_GATHER_INFO |
| 2013-07-25 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-198.nasl - Type : ACT_GATHER_INFO |
| 2013-07-18 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1904-2.nasl - Type : ACT_GATHER_INFO |
| 2013-07-16 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1904-1.nasl - Type : ACT_GATHER_INFO |
| 2013-05-03 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libxml2-130320.nasl - Type : ACT_GATHER_INFO |
| 2013-04-08 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_843a4641981611e29c51080027019be0.nasl - Type : ACT_GATHER_INFO |
| 2013-03-27 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2652.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 12:33:07 |
|
| 2024-08-02 12:22:21 |
|
| 2024-08-02 01:06:33 |
|
| 2024-02-02 01:21:42 |
|
| 2024-02-01 12:06:22 |
|
| 2023-11-07 21:45:42 |
|
| 2023-09-05 12:20:30 |
|
| 2023-09-05 01:06:16 |
|
| 2023-09-02 12:20:31 |
|
| 2023-09-02 01:06:21 |
|
| 2023-08-12 12:24:32 |
|
| 2023-08-12 01:06:23 |
|
| 2023-08-11 12:20:40 |
|
| 2023-08-11 01:06:33 |
|
| 2023-08-06 12:19:53 |
|
| 2023-08-06 01:06:23 |
|
| 2023-08-04 12:19:57 |
|
| 2023-08-04 01:06:26 |
|
| 2023-07-14 12:19:55 |
|
| 2023-07-14 01:06:20 |
|
| 2023-03-29 01:21:54 |
|
| 2023-03-28 12:06:28 |
|
| 2023-02-13 09:28:16 |
|
| 2022-10-11 12:17:48 |
|
| 2022-10-11 01:06:03 |
|
| 2021-05-04 12:23:22 |
|
| 2021-04-22 01:27:56 |
|
| 2020-05-24 01:10:11 |
|
| 2020-05-23 00:35:44 |
|
| 2019-07-03 01:04:45 |
|
| 2016-05-05 21:29:12 |
|
| 2016-04-26 22:41:21 |
|
| 2015-05-21 13:29:59 |
|
| 2014-12-16 13:24:58 |
|
| 2014-02-17 11:15:37 |
|
| 2014-01-23 00:18:56 |
|
| 2014-01-21 21:21:09 |
|
