CVE-2014-0191

2015-01-2114:59:00

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

AI Score

7.3

Confidence

High

EPSS

0.024

Percentile

90.1%

JSON

The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document.

Affected configurations

Nvd

Node

oraclefusion_middlewareMatch11.1.1.7.0

oraclefusion_middlewareMatch12.1.2.0.0

oraclefusion_middlewareMatch12.1.3.0.0

VendorProductVersionCPE
oraclefusion_middleware11.1.1.7.0cpe:2.3:a:oracle:fusion_middleware:11.1.1.7.0:*:*:*:*:*:*:*
oraclefusion_middleware12.1.2.0.0cpe:2.3:a:oracle:fusion_middleware:12.1.2.0.0:*:*:*:*:*:*:*
oraclefusion_middleware12.1.3.0.0cpe:2.3:a:oracle:fusion_middleware:12.1.3.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	fusion_middleware	11.1.1.7.0	cpe:2.3:a:oracle:fusion_middleware:11.1.1.7.0:::::::*
oracle	fusion_middleware	12.1.2.0.0	cpe:2.3:a:oracle:fusion_middleware:12.1.2.0.0:::::::*
oracle	fusion_middleware	12.1.3.0.0	cpe:2.3:a:oracle:fusion_middleware:12.1.3.0.0:::::::*