PSF-2017-7: High severity Expat Expat XML Parser Library vulnerability

Q: Which releases should be considered affected?

Expat XML Parser Library version 2.2.0 and earlier are identified as affected.

Q: What access does an attacker need?

The vector indicates network reachability, low attack complexity, no privileges, and no user interaction. Exploitation requires supplying a malformed external entity definition from an external DTD to the parser.

Q: What is the expected security impact?

The reported impact is denial of service through an infinite parsing loop. The vector indicates no confidentiality or integrity impact, with high availability impact.

Published Jul 25, 2017

Updated

XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.

Affected Software

1 affected component

Expat Expat XML Parser Library<=2.2.0

Event History

Jul 25, 2017

CVE Published

via OSV·08:29 PM

Data Sourced

via OSV·08:29 PM

DescriptionSeverity

Frequently Asked Questions

Which releases should be considered affected?

Expat XML Parser Library version 2.2.0 and earlier are identified as affected.

What access does an attacker need?

The vector indicates network reachability, low attack complexity, no privileges, and no user interaction. Exploitation requires supplying a malformed external entity definition from an external DTD to the parser.

What is the expected security impact?

The reported impact is denial of service through an infinite parsing loop. The vector indicates no confidentiality or integrity impact, with high availability impact.

PSF-2017-7: High severity Expat Expat XML Parser Library vulnerability

Affected Software

Event History

Frequently Asked Questions

Which releases should be considered affected?

What access does an attacker need?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which releases should be considered affected?

What access does an attacker need?

What is the expected security impact?