CVE-2013-0338: Buffer Overflow
A denial of service flaw was found in the way libxml2, a library providing support to read, modify and write XML and HTML files, performed string substitutions when entity values for entity references replacement (--noent option) was requested / enabled during the XML file parsing. A remote attacker could provide a specially-crafted XML file that, when processed would lead to excessive CPU consumption (denial of service).
Other sources
libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0338?
CVE-2013-0338 is considered a high severity vulnerability that can lead to denial of service attacks.
How do I fix CVE-2013-0338?
To mitigate CVE-2013-0338, update libxml2 to version 2.9.1 or later, where the vulnerability is addressed.
What systems are affected by CVE-2013-0338?
CVE-2013-0338 affects versions of libxml2 up to 2.9.0 and specific earlier versions, including 1.7.x to 1.8.x.
Can CVE-2013-0338 be exploited remotely?
Yes, CVE-2013-0338 can be exploited remotely through crafted XML files.
What types of attacks can CVE-2013-0338 enable?
CVE-2013-0338 can enable denial of service attacks, causing the application using libxml2 to crash.