Ruby Nokogiri Gem XML Parsing Multiple Denial of Service Vulnerabilities

Bugtraq ID:	64513
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-6460 CVE-2013-6461
Remote:	Yes
Local:	No
Published:	Dec 24 2013 12:00AM
Updated:	Dec 30 2013 12:50AM
Credit:	Jonas Nicklas, Yoko Harada, and John Shahid
Vulnerable:
Not Vulnerable:

Ruby Nokogiri Gem XML Parsing Multiple Denial of Service Vulnerabilities

Nokogiri Gem for Ruby is prone to multiple denial-of-service vulnerabilities when using JRuby.

Successful exploits may allow an attacker to cause an affected application to consume excessive amounts of memory and cause a crash, resulting in a denial-of-service condition.

Nokogiri 1.6.x versions prior to 1.6.1 and 1.5.x versions prior to 1.5.11 are vulnerable.

Ruby Nokogiri Gem XML Parsing Multiple Denial of Service Vulnerabilities

An attacker can exploit this issue using readily available tools.

Ruby Nokogiri Gem XML Parsing Multiple Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Ruby Nokogiri Gem XML Parsing Multiple Denial of Service Vulnerabilities

References: