CVE-2013-0339: Medium severity libxml2-devel vulnerability
A denial of service flaw was found in the way libxml2, a library providing support to read, modify and write XML and HTML files, performed string substitutions when entity values for external entity references replacement (--noent option) was requested / enabled during the XML file parsing. A remote attacker could provide a specially-crafted XML file containing an external entity expansion, when processed would lead to excessive CPU consumption (denial of service).
This a different flaw from CVE-2013-0338.
Upstream patch:
http://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab
Other sources
libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0339?
CVE-2013-0339 has been classified as a denial of service vulnerability, which can adversely impact the availability of affected systems.
How do I fix CVE-2013-0339?
To fix CVE-2013-0339, you should upgrade to the latest version of libxml2 that addresses this vulnerability.
Which versions of libxml2 are affected by CVE-2013-0339?
CVE-2013-0339 affects multiple versions of libxml2 prior to 2.9.1.
Can CVE-2013-0339 be exploited remotely?
Yes, CVE-2013-0339 can potentially be exploited remotely through malicious XML files.
What are the potential consequences of CVE-2013-0339?
The primary consequence of CVE-2013-0339 is a denial of service attack, which can cause the application using libxml2 to crash or become unresponsive.