CVE-2011-1754 jabberd14 1.6.1.1 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML docu...
MediumCVSS 5.0
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
jabberd14 1.6.1.1 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jabberd14 | <= 1.6.1.1 | No fix listed |
| jabberd14 | = 1.4.1 | No fix listed |
| jabberd14 | = 1.4.2 | No fix listed |
| jabberd14 | = 1.4.3 | No fix listed |
| jabberd14 | = 1.4.3.1 | No fix listed |
| jabberd14 | = 1.4.4 | No fix listed |
| jabberd14 | = 1.6.0 | No fix listed |
| jabberd14 | = 1.6.1 | No fix listed |
References
- packages.debian.org
- 44795 third-party-advisory vendor-advisory
- DSA-2249 vendor-advisory
- 48070 vdb-entry
- jabberd14-xml-dos(67771) vdb-entry