CVE-2015-3451: XEE
Published May 12, 2015
·Updated
The clone function in XML::LibXML before 2.0119 does not properly set the expandentities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) loadxml function.
Affected Software
11 affected components
Xml-libxml Project Xml-libxml Perl<=2.0118
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=14.10
Canonical Ubuntu Linux=15.04
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Fedoraproject Fedora=20
Fedoraproject Fedora=21
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
Event History
May 12, 2015
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What types of attacks can CVE-2015-3451 lead to?
CVE-2015-3451 can lead to XML external entity (XXE) attacks.
2
What is the affected software version for CVE-2015-3451?
CVE-2015-3451 affects XML::LibXML versions before 2.0119.
3
How can CVE-2015-3451 impact my application?
CVE-2015-3451 can allow remote attackers to exploit vulnerabilities via crafted XML data.
4
What is one of the key functions involved in CVE-2015-3451?
The _clone function in XML::LibXML is key in the vulnerability of CVE-2015-3451.
5
What should be done to mitigate CVE-2015-3451 vulnerabilities?
To mitigate CVE-2015-3451, update XML::LibXML to version 2.0119 or later.