CVE-2011-1755: High severity jabber jabberd2 vulnerability
jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Other sources
jabberd2, when expat is used, do not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."
References: [1] http://en.wikipedia.org/wiki/Billionlaughs [2] http://www.webcitation.org/5wwJidGdh
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1755?
CVE-2011-1755 has a severity level that is classified as a denial of service vulnerability.
How do I fix CVE-2011-1755?
To fix CVE-2011-1755, you should upgrade to jabberd2 version 2.2.14 or higher.
Which versions are vulnerable to CVE-2011-1755?
CVE-2011-1755 affects jabberd2 versions prior to 2.2.14.
What type of attack does CVE-2011-1755 enable?
CVE-2011-1755 allows remote attackers to induce memory and CPU consumption, leading to service denial.
Is CVE-2011-1755 related to earlier vulnerabilities?
Yes, CVE-2011-1755 is similar to CVE-2003-1564, as both involve issues with entity expansion in XML.