CVE-2011-1755 jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document co...
HighCVSS 7.5
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/jabberd2(Debian:12) | < 2.2.8-2.1 | 2.2.8-2.1 |
| debian/jabberd2(Debian:13) | < 2.2.8-2.1 | 2.2.8-2.1 |
| debian/jabberd2(Debian:14) | < 2.2.8-2.1 | 2.2.8-2.1 |
| jabberd2 | < 2.2.14 | 2.2.14 |
| fedoraproject fedora | = 13 | No fix listed |
| fedoraproject fedora | = 14 | No fix listed |
| fedoraproject fedora | = 15 | No fix listed |
| apple mac os x | < 10.6.8 | 10.6.8 |
| apple mac os x | >= 10.7.0, < 10.7.2 | 10.7.2 |
| apple mac os x server | < 10.6.8 | 10.6.8 |
| apple mac os x server | >= 10.7.0, < 10.7.2 | 10.7.2 |
References
- Debian Security Tracker CVE-2011-1755 vendor-advisory
- codex.xiaoka.com broken-link
- APPLE-SA-2011-10-12-3 mailing-list vendor-advisory
- FEDORA-2011-7801 mailing-list vendor-advisory
- FEDORA-2011-7805 mailing-list vendor-advisory
- FEDORA-2011-7818 mailing-list vendor-advisory
- 44787 broken-link third-party-advisory vendor-advisory
- 44957 broken-link third-party-advisory
- 45112 broken-link third-party-advisory
- support.apple.com third-party-advisory
- [jabberd2] 20110531 jabberd-2.2.14 release mailing-list release-notes
- RHSA-2011:0881 broken-link vendor-advisory
- RHSA-2011:0882 broken-link vendor-advisory
- 48250 broken-link third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking patch
- jabberd-xml-entity-dos(67770) third-party-advisory vdb-entry
- SUSE-SU-2011:0741 broken-link vendor-advisory