CVE-2014-2055: XEE

Q: What is the severity of CVE-2014-2055?

CVE-2014-2055 is considered a critical vulnerability due to its ability to allow remote attackers to read arbitrary files and potentially cause a denial of service.

Q: How do I fix CVE-2014-2055?

To fix CVE-2014-2055, update SabreDAV to version 1.7.11 or above, or apply the appropriate patches for affected ownCloud versions.

Q: Which versions of SabreDAV are affected by CVE-2014-2055?

CVE-2014-2055 affects all SabreDAV versions prior to 1.7.11.

Q: Can CVE-2014-2055 be exploited remotely?

Yes, CVE-2014-2055 can be exploited remotely through an XML External Entity (XXE) attack.

Q: What software specifically is impacted by CVE-2014-2055?

CVE-2014-2055 impacts SabreDAV versions before 1.7.11 and ownCloud Server versions before 6.0.2.

Published Feb 26, 2014

Updated

SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

Other sources

XEE issue that could expose local files or easily trigger a DOS attack.

Affected Software

70 affected componentsFixes available

composer/sabre/dav>=1.6.0, <1.6.99, >=1.7.0, <1.7.11, >=1.8.0, <1.8.9

1.7.11

Fruux Sabredav<=1.7.10

Fruux Sabredav=1.6.0

Fruux Sabredav=1.6.1

Fruux Sabredav=1.6.2

Fruux Sabredav=1.6.3

Fruux Sabredav=1.6.4

Fruux Sabredav=1.6.5

Fruux Sabredav=1.6.6

Fruux Sabredav=1.6.7

Fruux Sabredav=1.6.8

Fruux Sabredav=1.6.9

Fruux Sabredav=1.6.10

Fruux Sabredav=1.7.0

Fruux Sabredav=1.7.1

Fruux Sabredav=1.7.2

Fruux Sabredav=1.7.3

Fruux Sabredav=1.7.4

Fruux Sabredav=1.7.5

Fruux Sabredav=1.7.6

Fruux Sabredav=1.7.7

Fruux Sabredav=1.7.8

Fruux Sabredav=1.7.9

Fruux Sabredav=1.8.0

Fruux Sabredav=1.8.1

Fruux Sabredav=1.8.2

Fruux Sabredav=1.8.3

Fruux Sabredav=1.8.4

Fruux Sabredav=1.8.5

Fruux Sabredav=1.8.6

Fruux Sabredav=1.8.7

Fruux Sabredav=1.8.9

ownCloud ownCloud=6.0.0

ownCloud ownCloud=6.0.1

ownCloud ownCloud<=5.0.14

ownCloud ownCloud=5.0.0

ownCloud ownCloud=5.0.1

ownCloud ownCloud=5.0.2

ownCloud ownCloud=5.0.3

ownCloud ownCloud=5.0.4

ownCloud ownCloud=5.0.5

ownCloud ownCloud=5.0.6

ownCloud ownCloud=5.0.7

ownCloud ownCloud=5.0.8

ownCloud ownCloud=5.0.9

ownCloud ownCloud=5.0.10

ownCloud ownCloud=5.0.11

ownCloud ownCloud=5.0.12

ownCloud ownCloud=5.0.13

ownCloud ownCloud=5.0.14

composer/sabre/dav>=1.8.0<1.8.9

1.8.9

composer/sabre/dav>=1.6.0<1.7.11

1.7.11

ownCloud ownCloud Server=6.0.0

ownCloud ownCloud Server=6.0.1

ownCloud ownCloud Server<=5.0.14

ownCloud ownCloud Server=5.0.0

ownCloud ownCloud Server=5.0.1

ownCloud ownCloud Server=5.0.2

ownCloud ownCloud Server=5.0.3

ownCloud ownCloud Server=5.0.4

ownCloud ownCloud Server=5.0.5

ownCloud ownCloud Server=5.0.6

ownCloud ownCloud Server=5.0.7

ownCloud ownCloud Server=5.0.8

ownCloud ownCloud Server=5.0.9

ownCloud ownCloud Server=5.0.10

ownCloud ownCloud Server=5.0.11

ownCloud ownCloud Server=5.0.12

ownCloud ownCloud Server=5.0.13

ownCloud ownCloud Server=5.0.14

Event History

Feb 26, 2014

Advisory Published

10:13 PM

Jun 4, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Data Sourced

via NVD·02:55 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-2055?

CVE-2014-2055 is considered a critical vulnerability due to its ability to allow remote attackers to read arbitrary files and potentially cause a denial of service.

How do I fix CVE-2014-2055?