CVE-2013-0340
Summary
| CVE | CVE-2013-0340 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2014-01-21 18:55:00 UTC |
|---|
| Updated | 2023-11-07 02:13:00 UTC |
|---|
| Description | expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7c... |
MISC |
lists.apache.org |
|
| oss-security - CVE-2021-40439: Apache OpenOffice: Billion Laughs |
MLIST |
www.openwall.com |
|
| Full Disclosure: APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6 |
FULLDISC |
seclists.org |
|
| About the security content of iOS 14.8 and iPadOS 14.8 - Apple Support |
CONFIRM |
support.apple.com |
|
| Pony Mail! |
MLIST |
lists.apache.org |
|
| Malformed Request |
BID |
www.securityfocus.com |
|
| Expat: Multiple vulnerabilities (GLSA 201701-21) — Gentoo Security |
GENTOO |
security.gentoo.org |
|
| 90634 |
OSVDB |
www.osvdb.org |
|
| About the security content of Security Update 2021-005 Catalina - Apple Support |
CONFIRM |
support.apple.com |
|
| About the security content of macOS Big Sur 11.6 - Apple Support |
CONFIRM |
support.apple.com |
|
| Full Disclosure: APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina |
FULLDISC |
seclists.org |
|
| Pony Mail! |
MLIST |
lists.apache.org |
|
| Full Disclosure: APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15 |
FULLDISC |
seclists.org |
|
| Full Disclosure: APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8 |
FULLDISC |
seclists.org |
|
| Full Disclosure: APPLE-SA-2021-09-20-3 tvOS 15 |
FULLDISC |
seclists.org |
|
| Full Disclosure: APPLE-SA-2021-10-26-11 Additional information for APPLE-SA-2021-09-20-3 tvOS 15 |
FULLDISC |
seclists.org |
|
| Full Disclosure: APPLE-SA-2021-09-20-2 watchOS 8 |
FULLDISC |
seclists.org |
|
| oss-security - Re-evaluating expat/libxml2 CVE assignments |
MLIST |
www.openwall.com |
|
| About the security content of watchOS 8 - Apple Support |
CONFIRM |
support.apple.com |
|
| Full Disclosure: APPLE-SA-2021-10-26-10 Additional information for APPLE-SA-2021-09-20-2 watchOS 8 |
FULLDISC |
seclists.org |
|
| Full Disclosure: APPLE-SA-2021-10-26-9 Additional information for APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15 |
FULLDISC |
seclists.org |
|
| About the security content of tvOS 15 - Apple Support |
CONFIRM |
support.apple.com |
|
| expat Entity Expansion May Let Remote Users Deny Service - SecurityTracker |
SECTRACK |
securitytracker.com |
|
| oss-security - CVEs for libxml2 and expat internal and external XML entity expansion |
MLIST |
openwall.com |
|
| Pony Mail! |
MISC |
lists.apache.org |
|
| About the security content of iOS 15 and iPadOS 15 - Apple Support |
CONFIRM |
support.apple.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 378374 IBM Hypertext Transfer Protocol (HTTP) Server Denial of Service (DoS) Vulnerabilty (6839161)
- 591406 Siemens SIMATIC S7-1500 CPU GNU/Linux subsystem Multiple Vulnerabilities (SSB-439005, ICSA-22-104-13)
- 610370 Apple iOS 15 and iPadOS 15 Security Update Missing
- 670766 EulerOS Security Update for expat (EulerOS-SA-2021-2524)
- 670790 EulerOS Security Update for expat (EulerOS-SA-2021-2548)
- 690133 Free Berkeley Software Distribution (FreeBSD) Security Update for texproc/expat2 (5fa90ee6-bc9e-11eb-a287-e0d55e2a8bf9)
- 710322 Gentoo Linux Expat Multiple Vulnerabilities (GLSA 201701-21)
- 900422 Common Base Linux Mariner (CBL-Mariner) Security Update for expat (6264)
