Free and open-source vulnerability scanner
Mageni eases for you the vulnerability scanning, assessment, and management process. It is free and open-source.
Install NowAvailable for macOS, Windows, and Linux
CVE-2013-0339
CVE information
Published
Last Modified
CVSSv2.0 Severity
Impact Analysis
Description
libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE..
CVSSv2.0 Score
- Severity
- Medium
- Base Score
- 6.8/10
- Exploit Score
- 8.6/10
- Access Vector
- Network
- Access Complexity
- Medium
- Authentication Required
- None
- Impact Score
- 6.4/10
- Confidentiality Impact
- Partial
- Availability Impact
- Partial
- Integrity Impact
- Partial
Products Affected
| CPE | Affected | Vulnerable | Excluding | Edit |
|---|---|---|---|---|
| cpe:2.3:a:xmlsoft:libxml2:2.2.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.2.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.30:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.16:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.8.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.8.16:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.32:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.1.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.29:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.19:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.7:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.17:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.2.9:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.8.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.6:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.26:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.11:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.7.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.7.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.21:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.20:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.7:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.17:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.2.4:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.25:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.24:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.5.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.6:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.12:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.8:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.8.5:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.27:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.13:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.14:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.1.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.2.6:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.2.10:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.13:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.13:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.7.8:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.7.7:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.7.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.7:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.14:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.27:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.18:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.5.7:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.10:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.8.10:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.9.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.8.13:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.26:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.5.8:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.28:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.3:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.2.8:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.23:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.9:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.8.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.5:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.8:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.8.9:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.8:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.7.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.15:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.11:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.9.0:rc1:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.2.7:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.2.5:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.2.3:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.22:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.5:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.4:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.7.5:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.18:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.16:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.5.11:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.24:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.8.7:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.5:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.0.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.10:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.8.6:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.7.3:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.4:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.8.3:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.2.0:beta:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.20:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.31:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.7.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.2.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.7.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.21:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.7.6:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.7.3:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.9:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.23:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.12:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.25:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.9:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.5.4:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.30:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.8.1:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.11:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.3:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.8.14:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.7.4:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.7.4:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.28:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:1.8.4:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.5.10:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.12:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.4:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.14:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.22:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.3.2:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.3:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.2.11:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.4.29:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:a:xmlsoft:libxml2:2.6.6:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:* |
Yes
|
- | - | |
| cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:* |
Yes
|
- | - |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=915149
- http://seclists.org/oss-sec/2013/q4/182
- https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f
- http://secunia.com/advisories/55568
- http://www.openwall.com/lists/oss-security/2013/04/12/6
- http://www.ubuntu.com/usn/USN-1904-1
- http://secunia.com/advisories/52662
- http://openwall.com/lists/oss-security/2013/02/22/3
- http://secunia.com/advisories/54172
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html
- http://www.ubuntu.com/usn/USN-1904-2
- http://seclists.org/oss-sec/2013/q4/184
- http://openwall.com/lists/oss-security/2013/02/21/24
- http://www.debian.org/security/2013/dsa-2652
- http://seclists.org/oss-sec/2013/q4/188