CVE-2014-3660: Medium severity libxml2-devel vulnerability
IssueDescription:
A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption (denial of service) based on excessive entity substitutions, even if entity substitution was disabled, which is the parser default behavior.
Other sources
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3660?
CVE-2014-3660 is classified as a denial of service vulnerability that can lead to excessive CPU consumption.
How do I fix CVE-2014-3660?
To fix CVE-2014-3660, update the libxml2 library to version 2.9.2 or later.
Which software is affected by CVE-2014-3660?
CVE-2014-3660 affects various versions of the libxml2 library, particularly those prior to version 2.9.2.
Can CVE-2014-3660 be exploited remotely?
Yes, CVE-2014-3660 can be exploited by a remote attacker using a specially crafted XML file.
What can happen if CVE-2014-3660 is exploited?
If exploited, CVE-2014-3660 can lead to a denial of service, causing applications to consume excessive CPU resources.