CVE-2014-3660

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.

• xmlsoft libxml2 (<= 2.9.1) • xmlsoft libxml2 2.0.0 • xmlsoft libxml2 2.1.0 • xmlsoft libxml2 2.1.1 • xmlsoft libxml2 2.2.0 • xmlsoft libxml2 2.2.1 • xmlsoft libxml2 2.2.2 • xmlsoft libxml2 2.2.3 • xmlsoft libxml2 2.2.4 • xmlsoft libxml2 2.2.5 • xmlsoft libxml2 2.2.6 • xmlsoft libxml2 2.2.7 • xmlsoft libxml2 2.2.8 • xmlsoft libxml2 2.2.9 • xmlsoft libxml2 2.2.10 • xmlsoft libxml2 2.2.11 • xmlsoft libxml2 2.3.0 • xmlsoft libxml2 2.3.1 • xmlsoft libxml2 2.3.2 • xmlsoft libxml2 2.3.3 • xmlsoft libxml2 2.3.4 • xmlsoft libxml2 2.3.5 • xmlsoft libxml2 2.3.6 • xmlsoft libxml2 2.3.7 • xmlsoft libxml2 2.3.8 • xmlsoft libxml2 2.3.9 • xmlsoft libxml2 2.3.10 • xmlsoft libxml2 2.3.11 • xmlsoft libxml2 2.3.12 • xmlsoft libxml2 2.3.13 • xmlsoft libxml2 2.3.14 • xmlsoft libxml2 2.4.1 • xmlsoft libxml2 2.4.2 • xmlsoft libxml2 2.4.3 • xmlsoft libxml2 2.4.4 • xmlsoft libxml2 2.4.5 • xmlsoft libxml2 2.4.6 • xmlsoft libxml2 2.4.7 • xmlsoft libxml2 2.4.8 • xmlsoft libxml2 2.4.9 • xmlsoft libxml2 2.4.10 • xmlsoft libxml2 2.4.11 • xmlsoft libxml2 2.4.12 • xmlsoft libxml2 2.4.13 • xmlsoft libxml2 2.4.14 • xmlsoft libxml2 2.4.15 • xmlsoft libxml2 2.4.16 • xmlsoft libxml2 2.4.17 • xmlsoft libxml2 2.4.18 • xmlsoft libxml2 2.4.19 • xmlsoft libxml2 2.4.20 • xmlsoft libxml2 2.4.21 • xmlsoft libxml2 2.4.22 • xmlsoft libxml2 2.4.23 • xmlsoft libxml2 2.4.24 • xmlsoft libxml2 2.4.25 • xmlsoft libxml2 2.4.26 • xmlsoft libxml2 2.4.27 • xmlsoft libxml2 2.4.28 • xmlsoft libxml2 2.4.29 … and 54 more