CVE-2014-5266 WordPress Core < 3.9.2 - Denial of Service via XML #2
MediumCVSS 5.0
EPSS 25.2%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/wordpress(Debian:12) | < 3.9.2+dfsg-1 | 3.9.2+dfsg-1 |
| debian/wordpress(Debian:13) | < 3.9.2+dfsg-1 | 3.9.2+dfsg-1 |
| debian/wordpress(Debian:14) | < 3.9.2+dfsg-1 | 3.9.2+dfsg-1 |
| WordPress | <= 3.9.1 | No fix listed |
| WordPress | = 3.0 | No fix listed |
| WordPress | = 3.0.1 | No fix listed |
| WordPress | = 3.0.2 | No fix listed |
| WordPress | = 3.0.3 | No fix listed |
| WordPress | = 3.0.4 | No fix listed |
| WordPress | = 3.0.5 | No fix listed |
| WordPress | = 3.0.6 | No fix listed |
| WordPress | = 3.1 | No fix listed |
| WordPress | = 3.1.1 | No fix listed |
| WordPress | = 3.1.2 | No fix listed |
| WordPress | = 3.1.3 | No fix listed |
| WordPress | = 3.1.4 | No fix listed |
| WordPress | = 3.2 | No fix listed |
| WordPress | = 3.2-beta1 | No fix listed |
| WordPress | = 3.2.1 | No fix listed |
| WordPress | = 3.3 | No fix listed |
| WordPress | = 3.3.1 | No fix listed |
| WordPress | = 3.3.2 | No fix listed |
| WordPress | = 3.3.3 | No fix listed |
| WordPress | = 3.4.0 | No fix listed |
| WordPress | = 3.4.1 | No fix listed |
Show 104 more
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress | = 3.4.2 | No fix listed |
| WordPress | = 3.5.0 | No fix listed |
| WordPress | = 3.5.1 | No fix listed |
| WordPress | = 3.6 | No fix listed |
| WordPress | = 3.6.1 | No fix listed |
| WordPress | = 3.7 | No fix listed |
| WordPress | = 3.7.1 | No fix listed |
| WordPress | = 3.8 | No fix listed |
| WordPress | = 3.8.1 | No fix listed |
| WordPress | = 3.9.0 | No fix listed |
| drupal/drupal | = 6.0 | No fix listed |
| drupal/drupal | = 6.0-beta1 | No fix listed |
| drupal/drupal | = 6.0-beta2 | No fix listed |
| drupal/drupal | = 6.0-beta3 | No fix listed |
| drupal/drupal | = 6.0-beta4 | No fix listed |
| drupal/drupal | = 6.0-dev | No fix listed |
| drupal/drupal | = 6.0-rc1 | No fix listed |
| drupal/drupal | = 6.0-rc2 | No fix listed |
| drupal/drupal | = 6.0-rc3 | No fix listed |
| drupal/drupal | = 6.0-rc4 | No fix listed |
| drupal/drupal | = 6.1 | No fix listed |
| drupal/drupal | = 6.2 | No fix listed |
| drupal/drupal | = 6.3 | No fix listed |
| drupal/drupal | = 6.4 | No fix listed |
| drupal/drupal | = 6.5 | No fix listed |
| drupal/drupal | = 6.6 | No fix listed |
| drupal/drupal | = 6.7 | No fix listed |
| drupal/drupal | = 6.8 | No fix listed |
| drupal/drupal | = 6.9 | No fix listed |
| drupal/drupal | = 6.10 | No fix listed |
| drupal/drupal | = 6.11 | No fix listed |
| drupal/drupal | = 6.12 | No fix listed |
| drupal/drupal | = 6.13 | No fix listed |
| drupal/drupal | = 6.14 | No fix listed |
| drupal/drupal | = 6.15 | No fix listed |
| drupal/drupal | = 6.16 | No fix listed |
| drupal/drupal | = 6.17 | No fix listed |
| drupal/drupal | = 6.18 | No fix listed |
| drupal/drupal | = 6.19 | No fix listed |
| drupal/drupal | = 6.20 | No fix listed |
| drupal/drupal | = 6.21 | No fix listed |
| drupal/drupal | = 6.22 | No fix listed |
| drupal/drupal | = 6.23 | No fix listed |
| drupal/drupal | = 6.24 | No fix listed |
| drupal/drupal | = 6.25 | No fix listed |
| drupal/drupal | = 6.26 | No fix listed |
| drupal/drupal | = 6.27 | No fix listed |
| drupal/drupal | = 6.28 | No fix listed |
| drupal/drupal | = 6.29 | No fix listed |
| drupal/drupal | = 6.30 | No fix listed |
| drupal/drupal | = 6.31 | No fix listed |
| drupal/drupal | = 6.32 | No fix listed |
| drupal/drupal | = 7.0 | No fix listed |
| drupal/drupal | = 7.0-alpha1 | No fix listed |
| drupal/drupal | = 7.0-alpha2 | No fix listed |
| drupal/drupal | = 7.0-alpha3 | No fix listed |
| drupal/drupal | = 7.0-alpha4 | No fix listed |
| drupal/drupal | = 7.0-alpha5 | No fix listed |
| drupal/drupal | = 7.0-alpha6 | No fix listed |
| drupal/drupal | = 7.0-alpha7 | No fix listed |
| drupal/drupal | = 7.0-beta1 | No fix listed |
| drupal/drupal | = 7.0-beta2 | No fix listed |
| drupal/drupal | = 7.0-beta3 | No fix listed |
| drupal/drupal | = 7.0-dev | No fix listed |
| drupal/drupal | = 7.0-rc1 | No fix listed |
| drupal/drupal | = 7.0-rc2 | No fix listed |
| drupal/drupal | = 7.0-rc3 | No fix listed |
| drupal/drupal | = 7.0-rc4 | No fix listed |
| drupal/drupal | = 7.1 | No fix listed |
| drupal/drupal | = 7.2 | No fix listed |
| drupal/drupal | = 7.3 | No fix listed |
| drupal/drupal | = 7.4 | No fix listed |
| drupal/drupal | = 7.5 | No fix listed |
| drupal/drupal | = 7.6 | No fix listed |
| drupal/drupal | = 7.7 | No fix listed |
| drupal/drupal | = 7.8 | No fix listed |
| drupal/drupal | = 7.9 | No fix listed |
| drupal/drupal | = 7.10 | No fix listed |
| drupal/drupal | = 7.11 | No fix listed |
| drupal/drupal | = 7.12 | No fix listed |
| drupal/drupal | = 7.13 | No fix listed |
| drupal/drupal | = 7.14 | No fix listed |
| drupal/drupal | = 7.15 | No fix listed |
| drupal/drupal | = 7.16 | No fix listed |
| drupal/drupal | = 7.17 | No fix listed |
| drupal/drupal | = 7.18 | No fix listed |
| drupal/drupal | = 7.19 | No fix listed |
| drupal/drupal | = 7.20 | No fix listed |
| drupal/drupal | = 7.21 | No fix listed |
| drupal/drupal | = 7.22 | No fix listed |
| drupal/drupal | = 7.23 | No fix listed |
| drupal/drupal | = 7.24 | No fix listed |
| drupal/drupal | = 7.25 | No fix listed |
| drupal/drupal | = 7.26 | No fix listed |
| drupal/drupal | = 7.27 | No fix listed |
| drupal/drupal | = 7.28 | No fix listed |
| drupal/drupal | = 7.29 | No fix listed |
| drupal/drupal | = 7.30 | No fix listed |
| drupal/drupal | = 7.x-dev | No fix listed |
| debian linux | = 7.0 | No fix listed |
| WordPress(WordPress) | < 3.7 | 3.7 |
| WordPress(WordPress) | >= 3.7, < 3.7.4 | 3.7.4 |
| WordPress(WordPress) | >= 3.8, < 3.8.4 | 3.8.4 |
| WordPress(WordPress) | >= 3.9, < 3.9.2 | 3.9.2 |
References
- Debian Security Tracker CVE-2014-5266 vendor-advisory
- bugs.debian.org issue-tracking
- cgit.drupalcode.org
- cgit.drupalcode.org
- DSA-2999 vendor-advisory
- DSA-3001 vendor-advisory
- core.trac.wordpress.org
- wordpress.org vendor-advisory
- www.drupal.org vendor-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org