CVE-2014-8080 The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document,....
MediumCVSS 5.0
EPSS 5.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.10 | No fix listed |
| ruby-lang ruby | <= 1.9.3 | No fix listed |
| ruby-lang ruby | = 1.9.3 | No fix listed |
| ruby-lang ruby | = 1.9.3-p0 | No fix listed |
| ruby-lang ruby | = 1.9.3-p125 | No fix listed |
| ruby-lang ruby | = 1.9.3-p194 | No fix listed |
| ruby-lang ruby | = 1.9.3-p286 | No fix listed |
| ruby-lang ruby | = 1.9.3-p383 | No fix listed |
| ruby-lang ruby | = 1.9.3-p385 | No fix listed |
| ruby-lang ruby | = 1.9.3-p392 | No fix listed |
| ruby-lang ruby | = 1.9.3-p426 | No fix listed |
| ruby-lang ruby | = 1.9.3-p429 | No fix listed |
| ruby-lang ruby | = 1.9.3-p448 | No fix listed |
| ruby-lang ruby | = 1.9.3-p545 | No fix listed |
| ruby-lang ruby | = 1.9.3-p547 | No fix listed |
| ruby-lang ruby | = 2.0.0 | No fix listed |
| ruby-lang ruby | = 2.0.0-p0 | No fix listed |
| ruby-lang ruby | = 2.0.0-p195 | No fix listed |
| ruby-lang ruby | = 2.0.0-p247 | No fix listed |
| ruby-lang ruby | = 2.0.0-p451 | No fix listed |
| ruby-lang ruby | = 2.0.0-p481 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | = 2.0.0-p576 | No fix listed |
| ruby-lang ruby | = 2.1.1 | No fix listed |
| ruby-lang ruby | = 2.1.2 | No fix listed |
| ruby-lang ruby | = 2.1.3 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
References
- advisories.mageia.org
- APPLE-SA-2015-09-30-3 vendor-advisory
- openSUSE-SU-2014:1589 vendor-advisory
- openSUSE-SU-2015:0002 vendor-advisory
- openSUSE-SU-2015:0007 vendor-advisory
- RHSA-2014:1911 vendor-advisory
- RHSA-2014:1912 vendor-advisory
- RHSA-2014:1913 vendor-advisory
- RHSA-2014:1914 vendor-advisory
- 61607 third-party-advisory
- 62050 third-party-advisory
- 62748 third-party-advisory
- DSA-3157 vendor-advisory
- DSA-3159 vendor-advisory
- MDVSA-2015:129 vendor-advisory
- www.oracle.com
- 70935 vdb-entry
- USN-2397-1 vendor-advisory
- support.apple.com
- www.ruby-lang.org exploit vendor-advisory