Design/Logic Flaw

2014-05-2314:55:00

PRIOn knowledge base

www.prio-n.com

7 High

AI Score

Confidence

High

0.023 Low

EPSS

Percentile

89.8%

JSON

The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references, aka a “billion laughs attack.”

CPENameOperatorVersion
ekigale4.0.0
portable_tool_libraryeq2.10.1
portable_tool_libraryeq2.10.9
portable_tool_libraryeq2.10.7
portable_tool_libraryeq2.10.2
suse_linux_enterprise_desktopeq11.0 sp3
suse_linux_enterprise_software_development_kiteq11.0 sp3

Name	Operator	Version
ekiga	le	4.0.0
portable_tool_library	eq	2.10.1
portable_tool_library	eq	2.10.9
portable_tool_library	eq	2.10.7
portable_tool_library	eq	2.10.2
suse_linux_enterprise_desktop	eq	11.0 sp3
suse_linux_enterprise_software_development_kit	eq	11.0 sp3