CVE-2018-25282: Nmap 7.70 Denial of Service via XML Entity Expansion
Nmap 7.70 contains a denial of service vulnerability that allows local attackers to crash the application by processing malicious XML files with exponential entity expansion. Attackers can create a crafted XML file with nested entity definitions and open it through ZenMap's scan import functionality to cause the program to consume excessive system resources and crash.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-25282?
CVE-2018-25282 is classified as a high severity denial of service vulnerability.
How do I fix CVE-2018-25282?
To mitigate CVE-2018-25282, upgrade Nmap to a version that is not vulnerable, such as versions after 7.70.
Who is affected by CVE-2018-25282?
CVE-2018-25282 affects both Nmap and Zenmap running version 7.70.
What is the impact of CVE-2018-25282?
The impact of CVE-2018-25282 is the potential to crash the Nmap application when processing specially crafted XML files.
Can CVE-2018-25282 be exploited remotely?
CVE-2018-25282 requires local access to exploit, as it involves processing XML files.