CVE-2014-0191: Medium severity oracle fusion middleware vulnerability
It was discovered that libxml2, a library providing support to read, modify and write XML files, incorrectly performs entity substituton in the doctype prolog, even if the application using libxml2 disabled any entity substitution. A remote attacker could provide a specially-crafted XML file that, when processed, would lead to the exhaustion of CPU and memory resources or file descriptors.
Other sources
The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0191?
CVE-2014-0191 is considered to be a moderate severity vulnerability.
How do I fix CVE-2014-0191?
To fix CVE-2014-0191, update libxml2 to version 2.9.2 or later.
What applications are affected by CVE-2014-0191?
CVE-2014-0191 affects specific versions of Oracle Fusion Middleware, including 11.1.1.7.0, 12.1.2.0.0, and 12.1.3.0.0.
What could an attacker do with CVE-2014-0191?
An attacker could exploit CVE-2014-0191 to perform entity substitution, potentially leading to a denial of service or disclosure of sensitive information.
Is CVE-2014-0191 related to XML processing?
Yes, CVE-2014-0191 is specifically related to improper entity substitution in XML processing by the libxml2 library.