1. CVE-Search
  2. CVE-2014-8080
ID CVE-2014-8080
Summary The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack. <a href="http://cwe.mitre.org/data/definitions/611.html" target="_blank">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>
References
Vulnerable Configurations
  • cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
    cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
  • cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
    cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p385:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p385:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p392:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p392:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p426:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p426:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p429:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p429:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p448:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p448:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p545:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p545:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.9.3:p547:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.9.3:p547:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:*:p550:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:*:p550:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p0:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p195:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p247:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p451:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p451:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p481:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p481:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.0.0:p576:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.0.0:p576:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:2.1.3:*:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:2.1.3:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 30-10-2018 - 16:27)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:P
redhat via4
advisories
  • rhsa
    id RHSA-2014:1911
  • rhsa
    id RHSA-2014:1912
  • rhsa
    id RHSA-2014:1913
  • rhsa
    id RHSA-2014:1914
rpms
  • ruby-0:1.8.7.374-3.el6_6
  • ruby-debuginfo-0:1.8.7.374-3.el6_6
  • ruby-devel-0:1.8.7.374-3.el6_6
  • ruby-docs-0:1.8.7.374-3.el6_6
  • ruby-irb-0:1.8.7.374-3.el6_6
  • ruby-libs-0:1.8.7.374-3.el6_6
  • ruby-rdoc-0:1.8.7.374-3.el6_6
  • ruby-ri-0:1.8.7.374-3.el6_6
  • ruby-static-0:1.8.7.374-3.el6_6
  • ruby-tcltk-0:1.8.7.374-3.el6_6
  • ruby-0:2.0.0.353-22.el7_0
  • ruby-debuginfo-0:2.0.0.353-22.el7_0
  • ruby-devel-0:2.0.0.353-22.el7_0
  • ruby-doc-0:2.0.0.353-22.el7_0
  • ruby-irb-0:2.0.0.353-22.el7_0
  • ruby-libs-0:2.0.0.353-22.el7_0
  • ruby-tcltk-0:2.0.0.353-22.el7_0
  • rubygem-bigdecimal-0:1.2.0-22.el7_0
  • rubygem-io-console-0:0.4.2-22.el7_0
  • rubygem-json-0:1.7.7-22.el7_0
  • rubygem-minitest-0:4.3.2-22.el7_0
  • rubygem-psych-0:2.0.0-22.el7_0
  • rubygem-rake-0:0.9.6-22.el7_0
  • rubygem-rdoc-0:4.0.0-22.el7_0
  • rubygems-0:2.0.14-22.el7_0
  • rubygems-devel-0:2.0.14-22.el7_0
  • ruby193-ruby-0:1.9.3.484-50.el6
  • ruby193-ruby-0:1.9.3.484-50.el7
  • ruby193-ruby-debuginfo-0:1.9.3.484-50.el6
  • ruby193-ruby-debuginfo-0:1.9.3.484-50.el7
  • ruby193-ruby-devel-0:1.9.3.484-50.el6
  • ruby193-ruby-devel-0:1.9.3.484-50.el7
  • ruby193-ruby-doc-0:1.9.3.484-50.el6
  • ruby193-ruby-doc-0:1.9.3.484-50.el7
  • ruby193-ruby-irb-0:1.9.3.484-50.el6
  • ruby193-ruby-irb-0:1.9.3.484-50.el7
  • ruby193-ruby-libs-0:1.9.3.484-50.el6
  • ruby193-ruby-libs-0:1.9.3.484-50.el7
  • ruby193-ruby-tcltk-0:1.9.3.484-50.el6
  • ruby193-ruby-tcltk-0:1.9.3.484-50.el7
  • ruby193-rubygem-bigdecimal-0:1.1.0-50.el6
  • ruby193-rubygem-bigdecimal-0:1.1.0-50.el7
  • ruby193-rubygem-io-console-0:0.3-50.el6
  • ruby193-rubygem-io-console-0:0.3-50.el7
  • ruby193-rubygem-json-0:1.5.5-50.el6
  • ruby193-rubygem-json-0:1.5.5-50.el7
  • ruby193-rubygem-minitest-0:2.5.1-50.el6
  • ruby193-rubygem-minitest-0:2.5.1-50.el7
  • ruby193-rubygem-rake-0:0.9.2.2-50.el6
  • ruby193-rubygem-rake-0:0.9.2.2-50.el7
  • ruby193-rubygem-rdoc-0:3.9.5-50.el6
  • ruby193-rubygem-rdoc-0:3.9.5-50.el7
  • ruby193-rubygems-0:1.8.23-50.el6
  • ruby193-rubygems-0:1.8.23-50.el7
  • ruby193-rubygems-devel-0:1.8.23-50.el6
  • ruby193-rubygems-devel-0:1.8.23-50.el7
  • ruby200-ruby-0:2.0.0.353-24.el6
  • ruby200-ruby-0:2.0.0.353-24.el7
  • ruby200-ruby-debuginfo-0:2.0.0.353-24.el6
  • ruby200-ruby-debuginfo-0:2.0.0.353-24.el7
  • ruby200-ruby-devel-0:2.0.0.353-24.el6
  • ruby200-ruby-devel-0:2.0.0.353-24.el7
  • ruby200-ruby-doc-0:2.0.0.353-24.el6
  • ruby200-ruby-doc-0:2.0.0.353-24.el7
  • ruby200-ruby-irb-0:2.0.0.353-24.el6
  • ruby200-ruby-irb-0:2.0.0.353-24.el7
  • ruby200-ruby-libs-0:2.0.0.353-24.el6
  • ruby200-ruby-libs-0:2.0.0.353-24.el7
  • ruby200-ruby-tcltk-0:2.0.0.353-24.el6
  • ruby200-ruby-tcltk-0:2.0.0.353-24.el7
  • ruby200-rubygem-bigdecimal-0:1.2.0-24.el6
  • ruby200-rubygem-bigdecimal-0:1.2.0-24.el7
  • ruby200-rubygem-io-console-0:0.4.2-24.el6
  • ruby200-rubygem-io-console-0:0.4.2-24.el7
  • ruby200-rubygem-json-0:1.7.7-24.el6
  • ruby200-rubygem-json-0:1.7.7-24.el7
  • ruby200-rubygem-minitest-0:4.3.2-24.el6
  • ruby200-rubygem-minitest-0:4.3.2-24.el7
  • ruby200-rubygem-psych-0:2.0.0-24.el6
  • ruby200-rubygem-psych-0:2.0.0-24.el7
  • ruby200-rubygem-rake-0:0.9.6-24.el6
  • ruby200-rubygem-rake-0:0.9.6-24.el7
  • ruby200-rubygem-rdoc-0:4.0.0-24.el6
  • ruby200-rubygem-rdoc-0:4.0.0-24.el7
  • ruby200-rubygems-0:2.0.14-24.el6
  • ruby200-rubygems-0:2.0.14-24.el7
  • ruby200-rubygems-devel-0:2.0.14-24.el6
  • ruby200-rubygems-devel-0:2.0.14-24.el7
refmap via4
apple APPLE-SA-2015-09-30-3
bid 70935
confirm
debian
  • DSA-3157
  • DSA-3159
mandriva MDVSA-2015:129
secunia
  • 61607
  • 62050
  • 62748
suse
  • openSUSE-SU-2014:1589
  • openSUSE-SU-2015:0002
  • openSUSE-SU-2015:0007
ubuntu USN-2397-1
Last major update 30-10-2018 - 16:27
Published 03-11-2014 - 16:55
Last modified 30-10-2018 - 16:27
Back to Top