ID CVE-2013-0338
Summary libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.
References
Vulnerable Configurations
  • XMLSoft Libxml2 1.7.0
    cpe:2.3:a:xmlsoft:libxml2:1.7.0
  • XMLSoft Libxml2 1.7.1
    cpe:2.3:a:xmlsoft:libxml2:1.7.1
  • XMLSoft Libxml2 1.7.2
    cpe:2.3:a:xmlsoft:libxml2:1.7.2
  • XMLSoft Libxml2 1.7.3
    cpe:2.3:a:xmlsoft:libxml2:1.7.3
  • XMLSoft Libxml2 1.7.4
    cpe:2.3:a:xmlsoft:libxml2:1.7.4
  • XMLSoft Libxml2 1.8.0
    cpe:2.3:a:xmlsoft:libxml2:1.8.0
  • XMLSoft Libxml2 1.8.1
    cpe:2.3:a:xmlsoft:libxml2:1.8.1
  • XMLSoft Libxml2 1.8.2
    cpe:2.3:a:xmlsoft:libxml2:1.8.2
  • XMLSoft Libxml2 1.8.3
    cpe:2.3:a:xmlsoft:libxml2:1.8.3
  • XMLSoft Libxml2 1.8.4
    cpe:2.3:a:xmlsoft:libxml2:1.8.4
  • XMLSoft Libxml2 1.8.5
    cpe:2.3:a:xmlsoft:libxml2:1.8.5
  • XMLSoft Libxml2 1.8.6
    cpe:2.3:a:xmlsoft:libxml2:1.8.6
  • XMLSoft Libxml2 1.8.7
    cpe:2.3:a:xmlsoft:libxml2:1.8.7
  • XMLSoft Libxml2 1.8.9
    cpe:2.3:a:xmlsoft:libxml2:1.8.9
  • XMLSoft Libxml2 1.8.10
    cpe:2.3:a:xmlsoft:libxml2:1.8.10
  • XMLSoft Libxml2 1.8.13
    cpe:2.3:a:xmlsoft:libxml2:1.8.13
  • XMLSoft Libxml2 1.8.14
    cpe:2.3:a:xmlsoft:libxml2:1.8.14
  • XMLSoft Libxml2 1.8.16
    cpe:2.3:a:xmlsoft:libxml2:1.8.16
  • XMLSoft Libxml2 2.0.0
    cpe:2.3:a:xmlsoft:libxml2:2.0.0
  • XMLSoft Libxml2 2.1.0
    cpe:2.3:a:xmlsoft:libxml2:2.1.0
  • XMLSoft Libxml2 2.1.1
    cpe:2.3:a:xmlsoft:libxml2:2.1.1
  • XMLSoft Libxml2 2.2.0
    cpe:2.3:a:xmlsoft:libxml2:2.2.0
  • XMLSoft Libxml2 2.2.0 beta
    cpe:2.3:a:xmlsoft:libxml2:2.2.0:beta
  • XMLSoft Libxml2 2.2.1
    cpe:2.3:a:xmlsoft:libxml2:2.2.1
  • XMLSoft Libxml2 2.2.2
    cpe:2.3:a:xmlsoft:libxml2:2.2.2
  • XMLSoft Libxml2 2.2.3
    cpe:2.3:a:xmlsoft:libxml2:2.2.3
  • XMLSoft Libxml2 2.2.4
    cpe:2.3:a:xmlsoft:libxml2:2.2.4
  • XMLSoft Libxml2 2.2.5
    cpe:2.3:a:xmlsoft:libxml2:2.2.5
  • XMLSoft Libxml2 2.2.6
    cpe:2.3:a:xmlsoft:libxml2:2.2.6
  • XMLSoft Libxml2 2.2.7
    cpe:2.3:a:xmlsoft:libxml2:2.2.7
  • XMLSoft Libxml2 2.2.8
    cpe:2.3:a:xmlsoft:libxml2:2.2.8
  • XMLSoft Libxml2 2.2.9
    cpe:2.3:a:xmlsoft:libxml2:2.2.9
  • XMLSoft Libxml2 2.2.10
    cpe:2.3:a:xmlsoft:libxml2:2.2.10
  • XMLSoft Libxml2 2.2.11
    cpe:2.3:a:xmlsoft:libxml2:2.2.11
  • XMLSoft Libxml2 2.3.0
    cpe:2.3:a:xmlsoft:libxml2:2.3.0
  • XMLSoft Libxml2 2.3.1
    cpe:2.3:a:xmlsoft:libxml2:2.3.1
  • XMLSoft Libxml2 2.3.2
    cpe:2.3:a:xmlsoft:libxml2:2.3.2
  • XMLSoft Libxml2 2.3.3
    cpe:2.3:a:xmlsoft:libxml2:2.3.3
  • XMLSoft Libxml2 2.3.4
    cpe:2.3:a:xmlsoft:libxml2:2.3.4
  • XMLSoft Libxml2 2.3.5
    cpe:2.3:a:xmlsoft:libxml2:2.3.5
  • XMLSoft Libxml2 2.3.6
    cpe:2.3:a:xmlsoft:libxml2:2.3.6
  • XMLSoft Libxml2 2.3.7
    cpe:2.3:a:xmlsoft:libxml2:2.3.7
  • XMLSoft Libxml2 2.3.8
    cpe:2.3:a:xmlsoft:libxml2:2.3.8
  • XMLSoft Libxml2 2.3.9
    cpe:2.3:a:xmlsoft:libxml2:2.3.9
  • XMLSoft Libxml2 2.3.10
    cpe:2.3:a:xmlsoft:libxml2:2.3.10
  • XMLSoft Libxml2 2.3.11
    cpe:2.3:a:xmlsoft:libxml2:2.3.11
  • XMLSoft Libxml2 2.3.12
    cpe:2.3:a:xmlsoft:libxml2:2.3.12
  • XMLSoft Libxml2 2.3.13
    cpe:2.3:a:xmlsoft:libxml2:2.3.13
  • XMLSoft Libxml2 2.3.14
    cpe:2.3:a:xmlsoft:libxml2:2.3.14
  • XMLSoft Libxml2 2.4.1
    cpe:2.3:a:xmlsoft:libxml2:2.4.1
  • XMLSoft Libxml2 2.4.2
    cpe:2.3:a:xmlsoft:libxml2:2.4.2
  • XMLSoft Libxml2 2.4.3
    cpe:2.3:a:xmlsoft:libxml2:2.4.3
  • XMLSoft Libxml2 2.4.4
    cpe:2.3:a:xmlsoft:libxml2:2.4.4
  • XMLSoft Libxml2 2.4.5
    cpe:2.3:a:xmlsoft:libxml2:2.4.5
  • XMLSoft Libxml2 2.4.6
    cpe:2.3:a:xmlsoft:libxml2:2.4.6
  • XMLSoft Libxml2 2.4.7
    cpe:2.3:a:xmlsoft:libxml2:2.4.7
  • XMLSoft Libxml2 2.4.8
    cpe:2.3:a:xmlsoft:libxml2:2.4.8
  • XMLSoft Libxml2 2.4.9
    cpe:2.3:a:xmlsoft:libxml2:2.4.9
  • XMLSoft Libxml2 2.4.10
    cpe:2.3:a:xmlsoft:libxml2:2.4.10
  • XMLSoft Libxml2 2.4.11
    cpe:2.3:a:xmlsoft:libxml2:2.4.11
  • XMLSoft Libxml2 2.4.12
    cpe:2.3:a:xmlsoft:libxml2:2.4.12
  • XMLSoft Libxml2 2.4.13
    cpe:2.3:a:xmlsoft:libxml2:2.4.13
  • XMLSoft Libxml2 2.4.14
    cpe:2.3:a:xmlsoft:libxml2:2.4.14
  • XMLSoft Libxml2 2.4.15
    cpe:2.3:a:xmlsoft:libxml2:2.4.15
  • XMLSoft Libxml2 2.4.16
    cpe:2.3:a:xmlsoft:libxml2:2.4.16
  • XMLSoft Libxml2 2.4.17
    cpe:2.3:a:xmlsoft:libxml2:2.4.17
  • XMLSoft Libxml2 2.4.18
    cpe:2.3:a:xmlsoft:libxml2:2.4.18
  • XMLSoft Libxml2 2.4.19
    cpe:2.3:a:xmlsoft:libxml2:2.4.19
  • XMLSoft Libxml2 2.4.20
    cpe:2.3:a:xmlsoft:libxml2:2.4.20
  • XMLSoft Libxml2 2.4.21
    cpe:2.3:a:xmlsoft:libxml2:2.4.21
  • XMLSoft Libxml2 2.4.22
    cpe:2.3:a:xmlsoft:libxml2:2.4.22
  • XMLSoft Libxml2 2.4.23
    cpe:2.3:a:xmlsoft:libxml2:2.4.23
  • XMLSoft Libxml2 2.4.24
    cpe:2.3:a:xmlsoft:libxml2:2.4.24
  • XMLSoft Libxml2 2.4.25
    cpe:2.3:a:xmlsoft:libxml2:2.4.25
  • XMLSoft Libxml2 2.4.26
    cpe:2.3:a:xmlsoft:libxml2:2.4.26
  • XMLSoft Libxml2 2.4.27
    cpe:2.3:a:xmlsoft:libxml2:2.4.27
  • XMLSoft Libxml2 2.4.28
    cpe:2.3:a:xmlsoft:libxml2:2.4.28
  • XMLSoft Libxml2 2.4.29
    cpe:2.3:a:xmlsoft:libxml2:2.4.29
  • XMLSoft Libxml2 2.4.30
    cpe:2.3:a:xmlsoft:libxml2:2.4.30
  • XMLSoft Libxml2 2.5.0
    cpe:2.3:a:xmlsoft:libxml2:2.5.0
  • XMLSoft Libxml2 2.5.4
    cpe:2.3:a:xmlsoft:libxml2:2.5.4
  • XMLSoft Libxml2 2.5.7
    cpe:2.3:a:xmlsoft:libxml2:2.5.7
  • XMLSoft Libxml2 2.5.8
    cpe:2.3:a:xmlsoft:libxml2:2.5.8
  • Xmlsoft Libxml2 2.5.10
    cpe:2.3:a:xmlsoft:libxml2:2.5.10
  • XMLSoft Libxml2 2.5.11
    cpe:2.3:a:xmlsoft:libxml2:2.5.11
  • XMLSoft Libxml2 2.6.0
    cpe:2.3:a:xmlsoft:libxml2:2.6.0
  • XMLSoft Libxml2 2.6.1
    cpe:2.3:a:xmlsoft:libxml2:2.6.1
  • XMLSoft Libxml2 2.6.2
    cpe:2.3:a:xmlsoft:libxml2:2.6.2
  • XMLSoft Libxml2 2.6.3
    cpe:2.3:a:xmlsoft:libxml2:2.6.3
  • XMLSoft Libxml2 2.6.4
    cpe:2.3:a:xmlsoft:libxml2:2.6.4
  • XMLSoft Libxml2 2.6.5
    cpe:2.3:a:xmlsoft:libxml2:2.6.5
  • XMLSoft Libxml2 2.6.6
    cpe:2.3:a:xmlsoft:libxml2:2.6.6
  • XMLSoft Libxml2 2.6.7
    cpe:2.3:a:xmlsoft:libxml2:2.6.7
  • XMLSoft Libxml2 2.6.8
    cpe:2.3:a:xmlsoft:libxml2:2.6.8
  • XMLSoft Libxml2 2.6.9
    cpe:2.3:a:xmlsoft:libxml2:2.6.9
  • XMLSoft Libxml2 2.6.11
    cpe:2.3:a:xmlsoft:libxml2:2.6.11
  • XMLSoft Libxml2 2.6.12
    cpe:2.3:a:xmlsoft:libxml2:2.6.12
  • XMLSoft Libxml2 2.6.13
    cpe:2.3:a:xmlsoft:libxml2:2.6.13
  • XMLSoft Libxml2 2.6.14
    cpe:2.3:a:xmlsoft:libxml2:2.6.14
  • Xmlsoft Libxml2 2.6.16
    cpe:2.3:a:xmlsoft:libxml2:2.6.16
  • XMLSoft Libxml2 2.6.17
    cpe:2.3:a:xmlsoft:libxml2:2.6.17
  • XMLSoft Libxml2 2.6.18
    cpe:2.3:a:xmlsoft:libxml2:2.6.18
  • XMLSoft Libxml2 2.6.20
    cpe:2.3:a:xmlsoft:libxml2:2.6.20
  • XMLSoft Libxml2 2.6.21
    cpe:2.3:a:xmlsoft:libxml2:2.6.21
  • XMLSoft Libxml2 2.6.22
    cpe:2.3:a:xmlsoft:libxml2:2.6.22
  • XMLSoft Libxml2 2.6.23
    cpe:2.3:a:xmlsoft:libxml2:2.6.23
  • XMLSoft Libxml2 2.6.24
    cpe:2.3:a:xmlsoft:libxml2:2.6.24
  • XMLSoft Libxml2 2.6.25
    cpe:2.3:a:xmlsoft:libxml2:2.6.25
  • XMLSoft Libxml2 2.6.26
    cpe:2.3:a:xmlsoft:libxml2:2.6.26
  • XMLSoft Libxml2 2.6.27
    cpe:2.3:a:xmlsoft:libxml2:2.6.27
  • XMLSoft Libxml2 2.6.28
    cpe:2.3:a:xmlsoft:libxml2:2.6.28
  • XMLSoft Libxml2 2.6.29
    cpe:2.3:a:xmlsoft:libxml2:2.6.29
  • XMLSoft Libxml2 2.6.30
    cpe:2.3:a:xmlsoft:libxml2:2.6.30
  • XMLSoft Libxml2 2.6.31
    cpe:2.3:a:xmlsoft:libxml2:2.6.31
  • XMLSoft Libxml2 2.6.32
    cpe:2.3:a:xmlsoft:libxml2:2.6.32
  • XMLSoft Libxml2 2.7.0
    cpe:2.3:a:xmlsoft:libxml2:2.7.0
  • XMLSoft Libxml2 2.7.1
    cpe:2.3:a:xmlsoft:libxml2:2.7.1
  • XMLSoft Libxml2 2.7.2
    cpe:2.3:a:xmlsoft:libxml2:2.7.2
  • XMLSoft Libxml2 2.7.3
    cpe:2.3:a:xmlsoft:libxml2:2.7.3
  • XMLSoft Libxml2 2.7.4
    cpe:2.3:a:xmlsoft:libxml2:2.7.4
  • XMLSoft Libxml2 2.7.5
    cpe:2.3:a:xmlsoft:libxml2:2.7.5
  • XMLSoft Libxml2 2.7.6
    cpe:2.3:a:xmlsoft:libxml2:2.7.6
  • XMLSoft Libxml2 2.7.7
    cpe:2.3:a:xmlsoft:libxml2:2.7.7
  • XMLSoft Libxml2 2.7.8
    cpe:2.3:a:xmlsoft:libxml2:2.7.8
  • XMLSoft Libxml2 2.9.0
    cpe:2.3:a:xmlsoft:libxml2:2.9.0
  • XMLSoft Libxml2 2.9.0 release candidate 1
    cpe:2.3:a:xmlsoft:libxml2:2.9.0:rc1
  • Canonical Ubuntu Linux 8.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:8.04:-:lts
  • Canonical Ubuntu Linux 10.04 LTS
    cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts
  • Canonical Ubuntu Linux 11.10
    cpe:2.3:o:canonical:ubuntu_linux:11.10
  • Canonical Ubuntu Linux 12.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts
  • Canonical Ubuntu Linux 12.10
    cpe:2.3:o:canonical:ubuntu_linux:12.10
  • OpenSUSE 12.1
    cpe:2.3:o:opensuse:opensuse:12.1
  • OpenSUSE 12.2
    cpe:2.3:o:opensuse:opensuse:12.2
  • OpenSUSE 12.3
    cpe:2.3:o:opensuse:opensuse:12.3
CVSS
Base: 4.3 (as of 26-04-2013 - 13:04)
Impact:
Exploitability:
CWE CWE-119
CAPEC
  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
  • Overflow Binary Resource File
    An attack of this type exploits a buffer overflow vulnerability in the handling of binary resources. Binary resources may include music files like MP3, image files like JPEG files, and any other binary file. These attacks may pass unnoticed to the client machine through normal usage of files, such as a browser loading a seemingly innocent JPEG file. This can allow the attacker access to the execution stack and execute arbitrary code in the target process. This attack pattern is a variant of standard buffer overflow attacks using an unexpected vector (binary files) to wrap its attack and open up a new attack vector. The attacker is required to either directly serve the binary content to the victim, or place it in a locale like a MP3 sharing application, for the victim to download. The attacker then is notified upon the download or otherwise locates the vulnerability opened up by the buffer overflow.
  • Buffer Overflow via Symbolic Links
    This type of attack leverages the use of symbolic links to cause buffer overflows. An attacker can try to create or manipulate a symbolic link file such that its contents result in out of bounds data. When the target software processes the symbolic link file, it could potentially overflow internal buffers with insufficient bounds checking.
  • Overflow Variables and Tags
    This type of attack leverages the use of tags or variables from a formatted configuration data to cause buffer overflow. The attacker crafts a malicious HTML page or configuration file that includes oversized strings, thus causing an overflow.
  • Buffer Overflow via Parameter Expansion
    In this attack, the target software is given input that the attacker knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.
  • Buffer Overflow in an API Call
    This attack targets libraries or shared code modules which are vulnerable to buffer overflow attacks. An attacker who has access to an API may try to embed malicious code in the API function call and exploit a buffer overflow vulnerability in the function's implementation. All clients that make use of the code library thus become vulnerable by association. This has a very broad effect on security across a system, usually affecting more than one software process.
  • Buffer Overflow in Local Command-Line Utilities
    This attack targets command-line utilities available in a number of shells. An attacker can leverage a vulnerability found in a command-line utility to escalate privilege to root.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
nessus via4
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201412-11.NASL
    description The remote host is affected by the vulnerability described in GLSA-201412-11 (AMD64 x86 emulation base libraries: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in AMD64 x86 emulation base libraries. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker may be able to execute arbitrary code, cause a Denial of Service condition, or obtain sensitive information. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2016-11-11
    plugin id 79964
    published 2014-12-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79964
    title GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2013-0581.NASL
    description From Red Hat Security Advisory 2013:0581 : Updated libxml2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The libxml2 library is a development toolbox providing the implementation of various XML standards. A denial of service flaw was found in the way libxml2 performed string substitutions when entity values for entity references replacement was enabled. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, would lead to excessive CPU consumption. (CVE-2013-0338) All users of libxml2 are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The desktop must be restarted (log out, then log back in) for this update to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 68767
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68767
    title Oracle Linux 5 / 6 : libxml2 (ELSA-2013-0581)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2013-0581.NASL
    description Updated libxml2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The libxml2 library is a development toolbox providing the implementation of various XML standards. A denial of service flaw was found in the way libxml2 performed string substitutions when entity values for entity references replacement was enabled. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, would lead to excessive CPU consumption. (CVE-2013-0338) All users of libxml2 are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The desktop must be restarted (log out, then log back in) for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 64971
    published 2013-03-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64971
    title CentOS 5 / 6 : libxml2 (CESA-2013:0581)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2013-056.NASL
    description Multiple vulnerabilities was found and corrected in libxml2 : A heap-buffer overflow was found in the way libxml2 decoded certain XML entitites. A remote attacker could provide a specially crafted XML file, which once opened in an application linked against libxml would cause that application to crash, or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2012-5134). A denial of service flaw was found in the way libxml2 performed string substitutions when entity values for entity references replacement was enabled. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, would lead to excessive CPU consumption (CVE-2013-0338). An Off-by-one error in libxml2 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors (CVE-2011-3102). Multiple integer overflows in libxml2, on 64-bit Linux platforms allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors (CVE-2012-2807). The updated packages have been patched to correct these issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 66070
    published 2013-04-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66070
    title Mandriva Linux Security Advisory : libxml2 (MDVSA-2013:056)
  • NASL family Junos Local Security Checks
    NASL id JUNIPER_JSA10669.NASL
    description According to its self-reported version number, the remote Junos device is affected by multiple vulnerabilities in the libxml2 library : - A heap-based buffer overflow vulnerability exists which can result in arbitrary code execution. (CVE-2011-1944) - A denial of service vulnerability exists which can result in excessive CPU consumption. (CVE-2012-0841) - A heap-based buffer overflow vulnerability exists in the 'xmlParseAttValueComplex' function which can result in arbitrary code execution. (CVE-2012-5134) - A denial of service vulnerability exists due to excessive CPU and memory consumption in the processing of XML files containing entity declarations with long replacement text (also known as 'internal entity expansion with linear complexity'). (CVE-2013-0338) - A denial of service vulnerability exists related to the XML_PARSER_EOF state checking. (CVE-2013-2877) These vulnerabilities can be exploited by a remote attacker via a specially crafted XML file.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 80957
    published 2015-01-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80957
    title Juniper Junos libxml2 Library Multiple Vulnerabilities (JSA10669)
  • NASL family Misc.
    NASL id VMWARE_ESXI_5_1_BUILD_1483097_REMOTE.NASL
    description The remote VMware ESXi 5.1 host is affected by the following vulnerabilities : - A denial of service vulnerability exists in the bundled OpenSSL library that is triggered when handling OCSP response verification. A remote attacker can exploit this to crash the program. (CVE-2013-0166) - An error exists related to the SSL/TLS/DTLS protocols, CBC mode encryption and response time. An attacker can obtain plaintext contents of encrypted traffic via timing attacks. (CVE-2013-0169) - An error exists in the libxml2 library related to the expansion of XML internal entities that could allow denial of service attacks. (CVE-2013-0338) - A NULL pointer dereference flaw exists in the handling of Network File Copy (NFC) traffic. An attacker can exploit this by intercepting and modifying NFC traffic, to cause a denial of service condition. (CVE-2014-1207) - A denial of service vulnerability exists in the handling of invalid ports that could allow a guest user to crash the VMX process. (CVE-2014-1208)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 72037
    published 2014-01-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=72037
    title ESXi 5.1 < Build 1483097 Multiple Vulnerabilities (remote check)
  • NASL family Misc.
    NASL id VMWARE_ESXI_5_0_BUILD_1311177_REMOTE.NASL
    description The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities : - Multiple errors exist related to OpenSSL that could allow information disclosure or denial of service attacks. (CVE-2013-0166, CVE-2013-0169) - An error exists in the libxml2 library related to the expansion of XML internal entities. An attacker can exploit this to cause a denial of service. (CVE-2013-0338) - An unspecified error exists related to 'hostd-vmdb'. An attacker can exploit this to cause a denial of service. (CVE-2013-5970) - An error exists in the handling of certain Virtual Machine file descriptors. This may allow an unprivileged user with the 'Add Existing Disk' privilege to obtain read and write access to arbitrary files, possibly leading to arbitrary code execution after a host reboot. (CVE-2013-5973) - A NULL pointer dereference flaw exists in the handling of Network File Copy (NFC) traffic. This issue may lead to a denial of service if an attacker intercepts and modifies the NFC traffic. (CVE-2014-1207) - A denial of service vulnerability exists in the handling of invalid ports that could allow a guest user to crash the VMX process. (CVE-2014-1208)
    last seen 2019-02-21
    modified 2018-08-06
    plugin id 70879
    published 2013-11-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70879
    title ESXi 5.0 < Build 1311175 Multiple Vulnerabilities (remote check)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2652.NASL
    description Brad Hill of iSEC Partners discovered that many XML implementations are vulnerable to external entity expansion issues, which can be used for various purposes such as firewall circumvention, disguising an IP address, and denial-of-service. libxml2 was susceptible to these problems when performing string substitution during entity expansion.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 65695
    published 2013-03-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65695
    title Debian DSA-2652-1 : libxml2 - external entity expansion
  • NASL family SuSE Local Security Checks
    NASL id SUSE_SU-2013-1627-1.NASL
    description libxml2 has been updated to fix the following security issue : - CVE-2013-0338: libxml2 allowed context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka 'internal entity expansion' with linear complexity. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-31
    plugin id 83599
    published 2015-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=83599
    title SUSE SLES10 Security Update : libxml2 (SUSE-SU-2013:1627-1)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201311-06.NASL
    description The remote host is affected by the vulnerability described in GLSA-201311-06 (libxml2: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in libxml2. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially crafted document with an application linked against libxml2, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 70836
    published 2013-11-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70836
    title GLSA-201311-06 : libxml2: Multiple vulnerabilities
  • NASL family Web Servers
    NASL id ORACLE_HTTP_SERVER_CPU_JAN_2015.NASL
    description The version of Oracle HTTP Server installed on the remote host is affected by multiple vulnerabilities in the Web Listener subcomponent : - An integer overflow condition exists in libxml2 within file xpath.c, related to XPath expressions when adding a new namespace note. An unauthenticated, remote attacker can exploit this, via a crafted XML file, to cause a denial of service condition or the execution of arbitary code. (CVE-2011-1944) - An integer overflow condition exists in the HTTP server, specifically in the ap_pregsub() function within file server/util.c, when the mod_setenvif module is enabled. A local attacker can exploit this to gain elevated privileges by using an .htaccess file with a crafted combination of SetEnvIf directives and HTTP request headers. (CVE-2011-3607) - A flaw exists in libxml2, known as the 'internal entity expansion' with linear complexity issue, that allows specially crafted XML files to consume excessive CPU and memory resources. An unauthenticated, remote attacker can exploit this to cause a denial of service condition by using a specially crafted XML file containing an entity declaration with long replacement text and many references to this entity. (CVE-2013-0338) - An out-of-bounds read error exists in libxml2 within file parser.c due to a failure to check for the XML_PARSER_EOF state. An unauthenticated, remote attacker can exploit this, via a specially crafted document that ends abruptly, to cause a denial of service condition. (CVE-2013-2877) - A flaw exists within the mod_headers module in the HTTP server which allows bypassing the 'RequestHeader unset' directives. An unauthenticated, remote attacker can exploit this to inject arbitrary headers. This is done by placing a header in the trailer portion of data being sent using chunked transfer encoding. (CVE-2013-5704) - A flaw exists in the dav_xml_get_cdata() function in file main/util.c within the HTTP server mod_dav module due to incorrect stripping of whitespace characters from the CDATA sections. An unauthenticated, remote attacker via a specially crafted DAV WRITE request, can exploit this to cause a denial of service condition. (CVE-2013-6438) - A flaw exists in the log_cookie() function in file mod_log_config.c within the HTTP server mod_log_config module due to improper handling of specially crafted cookies during truncation. An unauthenticated, remote attacker can exploit this to cause a denial of service condition via a segmentation fault. (CVE-2014-0098) - A flaw exists in libxml2, specifically in the xmlParserHandlePEReference() function in file parser.c, due to loading external parameter entities even when entity substitution is disabled. An unauthenticated, remote attacker can exploit this issue, via a specially crafted XML file, to conduct XML External Entity (XXE) attacks that exhaust CPU and memory resources, resulting in a denial of service condition. (CVE-2014-0191) - A race condition exists in the HTTP server within the mod_status module when using a threaded Multi-Processing Module (MPM). If an unauthenticated, remote attacker is able to access status pages served by mod_status, the attacker can exploit this issue, by sending specially crafted requests, to cause the httpd child process to crash or possibly execute arbitrary code with the privileges of the user running the web server. (CVE-2014-0226) - An unspecified flaw exists in the Web Listener subcomponent that allows an unauthenticated, remote attacker to impact confidentiality, integrity, and availability. (CVE-2014-6571) - An unspecified flaw exists in the J2EE subcomponent that allows an unauthenticated, remote attacker to disclose potentially sensitive information. (CVE-2015-0372) - An unspecified flaw exists in the Web Listener subcomponent that allows an unauthenticated, remote attacker to cause a denial of service condition. (CVE-2015-0386)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 81002
    published 2015-01-27
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81002
    title Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (January 2015 CPU)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20130228_LIBXML2_ON_SL5_X.NASL
    description A denial of service flaw was found in the way libxml2 performed string substitutions when entity values for entity references replacement was enabled. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, would lead to excessive CPU consumption. (CVE-2013-0338) The desktop must be restarted (log out, then log back in) for this update to take effect.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 64964
    published 2013-03-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64964
    title Scientific Linux Security Update : libxml2 on SL5.x, SL6.x i386/x86_64
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-263.NASL
    description libxml2 was updated to limit internal entity expansion denial of service problems (IXE) (CVE-2013-0338) (bnc#805233)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 74946
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74946
    title openSUSE Security Update : libxml2 (openSUSE-SU-2013:0552-1)
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS11_LIBXML2_20130716.NASL
    description The remote Solaris system is missing necessary patches to address security updates : - libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka 'internal entity expansion' with linear complexity. (CVE-2013-0338)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 80690
    published 2015-01-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80690
    title Oracle Solaris Third-Party Patch Update : libxml2 (cve_2013_0338_denial_of)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_843A4641981611E29C51080027019BE0.NASL
    description Kurt Seifried reports : libxml2 is affected by the expansion of internal entities (which can be used to consume resources) and external entities (which can cause a denial of service against other services, be used to port scan, etc.)..
    last seen 2019-02-21
    modified 2018-11-21
    plugin id 65845
    published 2013-04-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65845
    title FreeBSD : libxml2 -- cpu consumption Dos (843a4641-9816-11e2-9c51-080027019be0)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_LIBXML2-8513.NASL
    description libxml2 has been updated to fix entity expansion problems : - Internal entity expansion within XML was not bounded, leading to simple small XML files being able to cause 'out of memory' denial of service conditions. (CVE-2013-0338)
    last seen 2019-02-21
    modified 2015-01-26
    plugin id 66301
    published 2013-05-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66301
    title SuSE 10 Security Update : libxml2 (ZYPP Patch Number 8513)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1782-1.NASL
    description It was discovered that libxml2 incorrectly handled XML entity expansion. An attacker could use this flaw to cause libxml2 to consume large amounts of resources, resulting in a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 65730
    published 2013-03-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=65730
    title Ubuntu 8.04 LTS / 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : libxml2 vulnerability (USN-1782-1)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2013-188.NASL
    description libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka 'internal entity expansion' with linear complexity.
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 69747
    published 2013-09-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69747
    title Amazon Linux AMI : libxml2 (ALAS-2013-188)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-0581.NASL
    description Updated libxml2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The libxml2 library is a development toolbox providing the implementation of various XML standards. A denial of service flaw was found in the way libxml2 performed string substitutions when entity values for entity references replacement was enabled. A remote attacker could provide a specially crafted XML file that, when processed by an application linked against libxml2, would lead to excessive CPU consumption. (CVE-2013-0338) All users of libxml2 are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. The desktop must be restarted (log out, then log back in) for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 64945
    published 2013-03-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=64945
    title RHEL 5 / 6 : libxml2 (RHSA-2013:0581)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_LIBXML2-130320.NASL
    description libxml2 has been updated to fix entity expansion problems : - Internal entity expansion within XML was not bounded, leading to simple small XML files being able to cause 'out of memory' denial of service conditions. (CVE-2013-0338)
    last seen 2019-02-21
    modified 2015-01-26
    plugin id 66300
    published 2013-05-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=66300
    title SuSE 11.2 Security Update : libxml2 (SAT Patch Number 7517)
  • NASL family VMware ESX Local Security Checks
    NASL id VMWARE_VMSA-2013-0009.NASL
    description a. vCenter Server and ESX userworld update for OpenSSL library The userworld OpenSSL library is updated to version openssl-0.9.8y to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2013-0169 and CVE-2013-0166 to these issues. b. Service Console (COS) update for OpenSSL library The Service Console updates for OpenSSL library is updated to version openssl-0.9.8e-26.el5_9.1 to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2013-0169 and CVE-2013-0166 to these issues. c. ESX Userworld and Service Console (COS) update for libxml2 library The ESX Userworld and Service Console libxml2 library is updated to version libxml2-2.6.26-2.1.21.el5_9.1 and libxml2-python-2.6.26-2.1.21.el5_9.1. to resolve a security issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2013-0338 to this issue. d. Service Console (COS) update for GnuTLS library The ESX service console GnuTLS RPM is updated to version gnutls-1.4.1-10.el5_9.1 to resolve a security issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2013-2116 to this issue. e. ESX third-party update for Service Console kernel The ESX Service Console Operating System (COS) kernel is updated to kernel-2.6.18-348.3.1.el5 which addresses several security issues in the COS kernel. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2013-0268 and CVE-2013-0871 to these issues.
    last seen 2019-02-21
    modified 2018-08-06
    plugin id 69193
    published 2013-08-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69193
    title VMSA-2013-0009 : VMware vSphere, ESX and ESXi updates to third-party libraries
  • NASL family Misc.
    NASL id VMWARE_ESX_VMSA-2013-0009_REMOTE.NASL
    description The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party libraries : - GnuTLS - Kernel - OpenSSL
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 89666
    published 2016-03-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89666
    title VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2013-0009) (remote check)
redhat via4
advisories
bugzilla
id 912400
title CVE-2013-0338 libxml2: CPU consumption DoS when performing string substitutions during entities expansion
oval
OR
  • AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331001
    • OR
      • AND
        • comment libxml2 is earlier than 0:2.6.26-2.1.21.el5_9.1
          oval oval:com.redhat.rhsa:tst:20130581002
        • comment libxml2 is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080032014
      • AND
        • comment libxml2-devel is earlier than 0:2.6.26-2.1.21.el5_9.1
          oval oval:com.redhat.rhsa:tst:20130581004
        • comment libxml2-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080032016
      • AND
        • comment libxml2-python is earlier than 0:2.6.26-2.1.21.el5_9.1
          oval oval:com.redhat.rhsa:tst:20130581006
        • comment libxml2-python is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080032018
  • AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhba:tst:20111656001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhba:tst:20111656002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhba:tst:20111656004
    • OR
      • AND
        • comment libxml2 is earlier than 0:2.7.6-12.el6_4.1
          oval oval:com.redhat.rhsa:tst:20130581012
        • comment libxml2 is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111749006
      • AND
        • comment libxml2-devel is earlier than 0:2.7.6-12.el6_4.1
          oval oval:com.redhat.rhsa:tst:20130581016
        • comment libxml2-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111749012
      • AND
        • comment libxml2-python is earlier than 0:2.7.6-12.el6_4.1
          oval oval:com.redhat.rhsa:tst:20130581014
        • comment libxml2-python is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111749010
      • AND
        • comment libxml2-static is earlier than 0:2.7.6-12.el6_4.1
          oval oval:com.redhat.rhsa:tst:20130581018
        • comment libxml2-static is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111749008
rhsa
id RHSA-2013:0581
released 2013-02-28
severity Moderate
title RHSA-2013:0581: libxml2 security update (Moderate)
rpms
  • libxml2-0:2.6.26-2.1.21.el5_9.1
  • libxml2-devel-0:2.6.26-2.1.21.el5_9.1
  • libxml2-python-0:2.6.26-2.1.21.el5_9.1
  • libxml2-0:2.7.6-12.el6_4.1
  • libxml2-devel-0:2.7.6-12.el6_4.1
  • libxml2-python-0:2.7.6-12.el6_4.1
  • libxml2-static-0:2.7.6-12.el6_4.1
refmap via4
confirm
debian DSA-2652
hp
  • HPSBGN03302
  • SSRT101996
mandriva MDVSA-2013:056
secunia
  • 52662
  • 55568
suse
  • SUSE-SU-2013:1627
  • openSUSE-SU-2013:0552
  • openSUSE-SU-2013:0555
ubuntu USN-1782-1
vmware via4
description The ESX Userworld and Service Console libxml2 library is updated to version libxml2-2.6.26-2.1.21.el5_9.1 and libxml2-python-2.6.26-2.1.21.el5_9.1. to resolve a security issue.
id VMSA-2013-0009
last_updated 2014-01-16T00:00:00
published 2013-07-31T00:00:00
title ESX Userworld and Service Console (COS) update for libxml2 library
Last major update 16-06-2016 - 21:59
Published 25-04-2013 - 19:55
Last modified 30-10-2018 - 12:27
Back to Top