UBUNTU-CVE-2016-9180

perl-XML-Twig: The option to expandexternalents, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting...

UBUNTU-CVE-2016-9181

perl-Image-Info: When parsing an SVG file, external entity expansion XXE was not disabled. An attacker could craft an SVG file which, when processed by an application using perl-Image-Info, could cause denial of service or, potentially, information disclosure...

CVE-2016-9180

perl-XML-Twig: The option to expandexternalents, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting...

Xxe

perl-Image-Info: When parsing an SVG file, external entity expansion XXE was not disabled. An attacker could craft an SVG file which, when processed by an application using perl-Image-Info, could cause denial of service or, potentially, information disclosure...

CVE-2016-9180

perl-XML-Twig: The option to expandexternalents, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting...

CVE-2016-9181

perl-Image-Info: When parsing an SVG file, external entity expansion XXE was not disabled. An attacker could craft an SVG file which, when processed by an application using perl-Image-Info, could cause denial of service or, potentially, information disclosure...

CVE-2016-9180

perl-XML-Twig: The option to expandexternalents, documented as controlling external entity expansion in XML::Twig does not work. External entities are always expanded, regardless of the option's setting...

openSUSE Security Update : subversion (openSUSE-2016-1435)

This update for subversion fixes the following issues : - Version update to 1.9.5 : - Unrestricted XML entity expansion in moddontdothat and Subversion clients using https:// boo1011552, CVE-2016-8734 - Client-side bugfixes : - fix accessing non-existent paths during reintegrate merge r1766699 et...

UBUNTU-CVE-2016-8734

Apache Subversion's moddontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory...

CVE-2016-8734

Apache Subversion's moddontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory...

FreeBSD : subversion -- Unrestricted XML entity expansion in mod_dontdothat and Subversionclients using http(s) (ac256985-b6a9-11e6-a3bf-206a8a720317)

The Apache Software Foundation reports : The moddontdothat module of subversion and subversion clients using https:// are vulnerable to a denial-of-service attack, caused by exponential XML entity expansion. The attack targets XML parsers causing targeted process to consume excessive amounts of...

CVE-2016-8734

Apache Subversion's moddontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory...

subversion -- Unrestricted XML entity expansion in mod_dontdothat and Subversionclients using http(s)

The Apache Software Foundation reports: The moddontdothat module of subversion and subversion clients using https:// are vulnerable to a denial-of-service attack, caused by exponential XML entity expansion. The attack targets XML parsers causing targeted process to consume excessive amounts of...

DEBIAN-CVE-2015-8978

In Soap Lite aka the SOAP::Lite extension for Perl 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copie...

CVE-2015-8978

CVE-2015-8978 is a documented XML exponential entity expansion (Billion Laughs) vulnerability in the Perl SOAP-Lite (SOAP::Lite) module, affecting SOAP-Lite 1.14 and earlier. The issue stems from nested XML entity definitions that explode when parsing external SOAP requests, potentially causing m...

CVE-2015-8978

In Soap Lite aka the SOAP::Lite extension for Perl 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copie...

php: libxml_disable_entity_loader setting is shared between threads

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxmldisableentityloader changes in other threads, which allows remote attackers to conduct XML External Entity XXE and XML Entity Expansion XEE attacks via a crafted XML...

CVE-2016-6312

A denial of service vulnerability was found in subversion. The moddontdothat component of the moddavsvn Apache module did not properly protect against exponential XML entity expansion attacks. An attacker with credentials to the webdav repository could send a crafted message that would result in...

OpenJDK: missing entity replacement limits (JAXP, 8149962)

Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500...

SAP NetWeaver AS JAVA 7.4 XXE Injection

Application: SAP NetWeaver AS JAVA Versions Affected: SAP NetWeaver AS JAVA 7.4 Vendor URL: http://SAP.com Bug: XXE Sent: 04.12.2015 Reported: 05.12.2015 Vendor response: 05.12.2015 Date of Public Advisory: 12.04.2016 Reference: SAP Security Note 2254389 Author: Vahagn Vardanyan ERPScan Descripti...