Lucene search
HistoryFeb 05, 2014 - 7:55 p.m.
CVE-2014-1439
cve-2014-1439
libxml_disable_entity_loader
hiphop virtual machine
php
xxe attacks
nvd
security advisory
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
7 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
70.3%
The libxml_disable_entity_loader function in runtime/ext/ext_simplexml.cpp in HipHop Virtual Machine for PHP (HHVM) before 2.4.0 and 2.3.x before 2.3.3 does not properly disable a certain libxml handler, which allows remote attackers to conduct XML External Entity (XXE) attacks.
Affected configurations
Node
hiphop_virtual_machine_for_php_projecthiphop_virtual_machine_for_phpRange≤2.3.2
ORhiphop_virtual_machine_for_php_projecthiphop_virtual_machine_for_phpMatch2.0.0
ORhiphop_virtual_machine_for_php_projecthiphop_virtual_machine_for_phpMatch2.0.1
ORhiphop_virtual_machine_for_php_projecthiphop_virtual_machine_for_phpMatch2.0.2
ORhiphop_virtual_machine_for_php_projecthiphop_virtual_machine_for_phpMatch2.1.0
ORhiphop_virtual_machine_for_php_projecthiphop_virtual_machine_for_phpMatch2.2.0
ORhiphop_virtual_machine_for_php_projecthiphop_virtual_machine_for_phpMatch2.3.0
ORhiphop_virtual_machine_for_php_projecthiphop_virtual_machine_for_phpMatch2.3.1
Related
cvelist
cvelist
CVE-2014-1439
2014-02-05 19:00:00
prion
prion
Xxe
2014-02-05 19:55:00
nvd
nvd
CVE-2014-1439
2014-02-05 19:55:28
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
7 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
70.3%
Related for CVE-2014-1439