CVE-2003-1564: Medium severity XMLSoft Libxml2 vulnerability
Common Vulnerabilities and Exposures assigned an identifier CVE-2003-1564 to the following vulnerability:
libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."
References: http://www.stylusstudio.com/xmldev/200302/post20020.html http://www.reddit.com/r/programming/comments/65843/timetoupgradelibxml2 http://xmlsoft.org/news.html http://mail.gnome.org/archives/xml/2008-August/msg00034.html
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libxml2-develto a version that resolves this vulnerability.Fixed in 2.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2003-1564?
CVE-2003-1564 has been classified as a denial of service vulnerability that can lead to significant memory and CPU consumption.
How do I fix CVE-2003-1564?
To mitigate CVE-2003-1564, upgrade libxml2 to version 2.5.0 or later.
What versions of libxml2 are affected by CVE-2003-1564?
CVE-2003-1564 affects versions of libxml2 prior to 2.5.0.
What type of attack does CVE-2003-1564 facilitate?
CVE-2003-1564 allows context-dependent attackers to cause denial of service through crafted XML documents with extensive nested entity references.
Can CVE-2003-1564 be exploited remotely?
Yes, CVE-2003-1564 can be exploited remotely if a vulnerable version of libxml2 processes malicious XML content from an untrusted source.