CVE-2011-2188 LuaExpat before 1.2.0 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document con...
MediumCVSS 5.0
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
LuaExpat before 1.2.0 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/lua-expat(Debian:12) | < 1.2.0-1 | 1.2.0-1 |
| debian/lua-expat(Debian:13) | < 1.2.0-1 | 1.2.0-1 |
| debian/lua-expat(Debian:14) | < 1.2.0-1 | 1.2.0-1 |
| matthewwild luaexpat | <= 1.1.0 | No fix listed |
| matthewwild luaexpat | = 1.0 | No fix listed |
| matthewwild luaexpat | = 1.0.1 | No fix listed |
| matthewwild luaexpat | = 1.0.2 | No fix listed |
References
- Debian Security Tracker CVE-2011-2188 vendor-advisory
- bugs.debian.org
- 44866 third-party-advisory vendor-advisory
- [oss-security] 20110606 Re: CVE Request -- LuaExpat -- Prone to XML "billion laughs attack" mailing-list
- [oss-security] 20110606 CVE Request -- LuaExpat -- Prone to XML "billion laughs attack" mailing-list
- 48123 vdb-entry
- bugzilla.redhat.com
- luaexpat-xml-dos(67862) vdb-entry
- bugs.debian.org issue-tracking