CVE-2013-1864: Buffer Overflow
The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references, aka a "billion laughs attack."
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1864?
CVE-2013-1864 has a severity rating that indicates it can lead to denial of service due to excessive memory and CPU consumption.
How do I fix CVE-2013-1864?
To mitigate CVE-2013-1864, upgrade the Portable Tool Library to version 2.10.10 or later and ensure Ekiga is updated to version 4.0.1 or later.
Which versions are affected by CVE-2013-1864?
CVE-2013-1864 affects Portable Tool Library versions prior to 2.10.10 and Ekiga versions up to and including 4.0.0.
What is the nature of the vulnerability in CVE-2013-1864?
CVE-2013-1864 allows attackers to exploit improper recursion detection during entity expansion, leading to potential denial of service.
Is CVE-2013-1864 a local or remote vulnerability?
CVE-2013-1864 is considered a remote vulnerability as it can be exploited by sending a crafted PXML document from an external source.