CVE-2013-0340

תיאור (מקור, אנגלית)

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

מדדים

EPSS — סבירות ניצול

19% (אחוזון 100) נכון ל-11/10/2026

CWE

CWE-611

מוצרים מושפעים

libexpat_project: libexpat; python: python; apple: ipados; apple: iphone os; apple: macos; apple: tvos; apple: watchos

קישורים

• http://openwall.com/lists/oss-security/2013/02/22/3 ExploitMailing ListThird Party Advisory
• http://openwall.com/lists/oss-security/2013/02/22/3 ExploitMailing ListThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Oct/61 Mailing ListThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Oct/62 Mailing ListThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Oct/63 Mailing ListThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Sep/33 Mailing ListThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Sep/34 Mailing ListThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Sep/35 Mailing ListThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Sep/38 Mailing ListThird Party Advisory
• http://seclists.org/fulldisclosure/2021/Sep/39 Mailing ListThird Party Advisory