CVE-2014-3660
libxml2 - security update
EPSS 4.0%
描述
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
如何修補 CVE-2014-3660
要修補 CVE-2014-3660,請將受影響套件升級到下列已修補版本。
- Debian/libxml2—升級至 2.9.2+dfsg1-1 或更新版本
- Debian/libxml2—升級至 2.7.8.dfsg-2+squeeze10 或更新版本
- —升級至 2.8.0+dfsg1-7+wheezy2 或更新版本
CVE-2014-3660 正在被利用嗎?
低 — EPSS 為 4.0%,目前沒有觀察到大規模利用活動。
受影響套件(3)
- from 0, < 2.9.2+dfsg1-1
- from 0, < 2.7.8.dfsg-2+squeeze10
- from 0, < 2.8.0+dfsg1-7+wheezy2