CVE-2013-0339

libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.

• xmlsoft libxml2 (<= 2.9.1) • xmlsoft libxml2 1.7.0 • xmlsoft libxml2 1.7.1 • xmlsoft libxml2 1.7.2 • xmlsoft libxml2 1.7.3 • xmlsoft libxml2 1.7.4 • xmlsoft libxml2 1.8.0 • xmlsoft libxml2 1.8.1 • xmlsoft libxml2 1.8.2 • xmlsoft libxml2 1.8.3 • xmlsoft libxml2 1.8.4 • xmlsoft libxml2 1.8.5 • xmlsoft libxml2 1.8.6 • xmlsoft libxml2 1.8.7 • xmlsoft libxml2 1.8.9 • xmlsoft libxml2 1.8.10 • xmlsoft libxml2 1.8.13 • xmlsoft libxml2 1.8.14 • xmlsoft libxml2 1.8.16 • xmlsoft libxml2 2.0.0 • xmlsoft libxml2 2.1.0 • xmlsoft libxml2 2.1.1 • xmlsoft libxml2 2.2.0 • xmlsoft libxml2 2.2.1 • xmlsoft libxml2 2.2.2 • xmlsoft libxml2 2.2.3 • xmlsoft libxml2 2.2.4 • xmlsoft libxml2 2.2.5 • xmlsoft libxml2 2.2.6 • xmlsoft libxml2 2.2.7 • xmlsoft libxml2 2.2.8 • xmlsoft libxml2 2.2.9 • xmlsoft libxml2 2.2.10 • xmlsoft libxml2 2.2.11 • xmlsoft libxml2 2.3.0 • xmlsoft libxml2 2.3.1 • xmlsoft libxml2 2.3.2 • xmlsoft libxml2 2.3.3 • xmlsoft libxml2 2.3.4 • xmlsoft libxml2 2.3.5 • xmlsoft libxml2 2.3.6 • xmlsoft libxml2 2.3.7 • xmlsoft libxml2 2.3.8 • xmlsoft libxml2 2.3.9 • xmlsoft libxml2 2.3.10 • xmlsoft libxml2 2.3.11 • xmlsoft libxml2 2.3.12 • xmlsoft libxml2 2.3.13 • xmlsoft libxml2 2.3.14 • xmlsoft libxml2 2.4.1 • xmlsoft libxml2 2.4.2 • xmlsoft libxml2 2.4.3 • xmlsoft libxml2 2.4.4 • xmlsoft libxml2 2.4.5 • xmlsoft libxml2 2.4.6 • xmlsoft libxml2 2.4.7 • xmlsoft libxml2 2.4.8 • xmlsoft libxml2 2.4.9 • xmlsoft libxml2 2.4.10 • xmlsoft libxml2 2.4.11 … and 73 more