1447 matches found
MGASA-2014-0328 Updated wordpress packages fix security vulnerabilities
Multiple vulnerabilities in WordPress before 3.9.2, including denial of service and information disclosure issues related to XML entity expansion. The wordpress package has been updated to version 3.9.2 to fix these issues. See the release announcement for more details...
MGASA-2014-0329 Updated drupal packages fix security vulnerability
A denial of service issue exists in Drupal before 7.31, due to XML entity expansion in a publicly accessible XML-RPC endpoint. The drupal package has been updated to version 7.31 to fix this issue and other bugs. See the upstream advisory and release notes for more details...
Updated wordpress packages fix security vulnerabilities
Multiple vulnerabilities in WordPress before 3.9.2, including denial of service and information disclosure issues related to XML entity expansion. The wordpress package has been updated to version 3.9.2 to fix these issues. See the release announcement for more details...
Millions of WordPress and Drupal Websites Vulnerable to DoS Attack
Users running the website on a self-hosted WordPress or on Drupal are strongly recommended to update their websites to the latest version immediately. A moderately critical vulnerability was discovered in the way Drupal and WordPress implement XMLRPC, which can lead an attacker to disable your...
RHEL 7 : libvirt (RHSA-2014:0914)
Updated libvirt packages that fix one security issue and three bugs are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
libvirt: unsafe parsing of XML documents allows libvirt DoS and/or arbitrary file read
It was found that libvirt passes the XMLPARSENOENT flag when parsing XML documents using the libxml2 library, in which case all XML entities in the parsed documents are expanded. A user able to force libvirtd to parse an XML document with an entity pointing to a file could use this flaw to read t...
libvirt: unsafe parsing of XML documents allows libvirt DoS and/or arbitrary file read
It was found that libvirt passes the XMLPARSENOENT flag when parsing XML documents using the libxml2 library, in which case all XML entities in the parsed documents are expanded. A user able to force libvirtd to parse an XML document with an entity pointing to a file could use this flaw to read t...
PicketLink: XXE via insecure DocumentBuilderFactory usage
It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the...
PicketLink: XXE via insecure DocumentBuilderFactory usage
It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the...
PicketLink: XXE via insecure DocumentBuilderFactory usage
It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the...
PicketLink: XXE via insecure DocumentBuilderFactory usage
It was found that the implementation of the org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method provided a DocumentBuilderFactory that would expand entity references. A remote, unauthenticated attacker could use this flaw to read files accessible to the user running the...
CVE-2014-3481
org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform JEAP before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity XXE issue...
JAX-RS: Information disclosure via XML eXternal Entity (XXE)
It was found that the default context parameters as provided to RESTEasy deployments by JBoss EAP did not explicitly disable external entity expansion for RESTEasy. A remote attacker could use this flaw to perform XML External Entity XXE attacks on RESTEasy applications accepting XML input...
openSUSE Security Update : libqt4 (openSUSE-SU-2014:0125-1)
Fixes XML Entity Expansion Denial of Service bnc856832, CVE-2013-4549 - add backported patch libqt4-disallow-deep-or-widely-nested-entity-references. patch - add backported patch libqt4-fully-expand-all-entities.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...
openSUSE Security Update : libqt5-qtbase (openSUSE-SU-2014:0173-1)
added patches : - disallow-deep-or-widely-nested-entity-references.patch: upstream fix for bnc856832 and CVE-2013-4549: xml entity expansion attacks %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...
openSUSE Security Update : libqt4 (openSUSE-SU-2014:0067-1)
Fixes XML Entity Expansion Denial of Service bnc856832, CVE-2013-4549 - add backported patch libqt4-disallow-deep-or-widely-nested-entity-references. patch - add backported patch libqt4-fully-expand-all-entities.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...
openSUSE Security Update : libqt4 (openSUSE-SU-2014:0070-1)
Fixes XML Entity Expansion Denial of Service bnc856832, CVE-2013-4549 - add backported patch libqt4-disallow-deep-or-widely-nested-entity-references. patch - add backported patch libqt4-fully-expand-all-entities.patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...
CentOS Update for libvirt CESA-2014:0560 centos6
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
libvirt: unsafe parsing of XML documents allows libvirt DoS and/or arbitrary file read
It was found that libvirt passes the XMLPARSENOENT flag when parsing XML documents using the libxml2 library, in which case all XML entities in the parsed documents are expanded. A user able to force libvirtd to parse an XML document with an entity pointing to a file could use this flaw to read t...
