Code injection

Cisco Unified Presence before 8.54 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption, and process crash via a crafted XML document containing a large number of nested entity references, aka Bug IDs...

CVE-2011-3288

CVE-2011-3288 affects Cisco Unified Presence before 8.5(4). The vulnerability arises from improper detection of recursion during XML entity expansion, allowing a remote attacker to craft an XML document with deeply nested entity references to cause memory and CPU exhaustion and potentially crash ...

CVE-2011-3288

Cisco Unified Presence before 8.54 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service memory and CPU consumption, and process crash via a crafted XML document containing a large number of nested entity references, aka Bug IDs...