Input validation error in Libxml2 - CVE-2014-0191

Vulnerability identifier: #VU33820

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-0191

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document.

Libxml2
Gentoo Linux
Amazon Linux AMI
Fedora
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
libxml2 (Alpine package)
libxml2
libxml2-doc
libxml2-python
libxml2-32bit
libxml2-debuginfo
libxml2-debugsource
libxml2-python-debuginfo
libxml2-python-debugsource
mingw-libxml2
IBM Integrated Management Module

Install update from vendor's website.

Libxml2 - update to 2.9.2
libxml2 (Alpine package) - update to 2.9.0-r4
IBM Integrated Management Module - update to 1.48 YUOOG8C
libxml2 - update to 2.7.6-0.77.36.1
libxml2-doc - update to 2.7.6-0.77.36.1
libxml2-python - update to 2.7.6-0.77.36.1
libxml2-32bit - update to 2.7.6-0.77.36.1
libxml2-debuginfo - update to 2.7.6-0.77.36.1
libxml2-debugsource - update to 2.7.6-0.77.36.1
libxml2-python-debuginfo - update to 2.7.6-0.77.36.1
libxml2-python-debugsource - update to 2.7.6-0.77.36.1
libxml2 - update to 2.9.1-7.fc21
mingw-libxml2 - addressed in versions 2.9.2-1.el7, 2.9.2-1.fc21

• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html
• http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html
• http://rhn.redhat.com/errata/RHSA-2015-0749.html
• http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
• http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
• http://www.securityfocus.com/bid/67233
• http://www-01.ibm.com/support/docview.wss?uid=swg21678183
• http://xmlsoft.org/news.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1090976
• https://exchange.xforce.ibmcloud.com/vulnerabilities/93092
• https://git.gnome.org/browse/libxml2/commit/?id=9cd1c3cfbd32655d60572c0a413e017260c854df
• https://support.apple.com/kb/HT205030
• https://support.apple.com/kb/HT205031

• Input validation error in Libxml2
• Input validation error in libxml2 (Alpine package)
• Amazon Linux AMI update for libxml2
• Gentoo update for libxml2
• SUSE update for libxml2
• Multiple vulnerabilities in IBM System x Integrated Management Module (IMM)
• Fedora 21 update for mingw-libxml2
• Fedora EPEL 7 update for mingw-libxml2
• Fedora 21 update for libxml2