PRIOn knowledge basePRION:CVE-2014-0191Design/Logic Flaw
6.5 Medium
AI Score
Confidence
Low
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.024 Low
EPSS
Percentile
89.5%
The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document.
| CPE | Name | Operator | Version |
|---|---|---|---|
| fusion_middleware | eq | 12.1.3.0.0 | |
| fusion_middleware | eq | 11.1.1.7.0 | |
| fusion_middleware | eq | 12.1.2.0.0 |
References
lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
lists.apple.com/archives/security-announce/2015/Aug/msg00002.html
lists.opensuse.org/opensuse-updates/2015-12/msg00120.html
rhn.redhat.com/errata/RHSA-2015-0749.html
www-01.ibm.com/support/docview.wss?uid=swg21678183
www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
www.securityfocus.com/bid/67233
xmlsoft.org/news.html
bugzilla.redhat.com/show_bug.cgi?id=1090976
exchange.xforce.ibmcloud.com/vulnerabilities/93092
git.gnome.org/browse/libxml2/commit/?id=9cd1c3cfbd32655d60572c0a413e017260c854df
support.apple.com/kb/HT205030
support.apple.com/kb/HT205031
Related
6.5 Medium
AI Score
Confidence
Low
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.024 Low
EPSS
Percentile
89.5%