NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses

Several XML parsing sites in NLTK still used xml.etree.ElementTree directly, which honours declarations in a document's internal DTD subset. A crafted document a few hundred bytes long can expand to megabytes in memory each nesting level multiplies by ten, a denial-of-service. Affected call sites...

ruby security update

1.8.5-29 - Fix regression introduced by fix for entity expansion DOS vulnerability in REXML https://bugs.ruby-lang.org/issues/7961 ruby-2.0.0-add-missing-rexml-require.patch - Related: rhbz915377 1.8.5-28 - Addresses entity expansion DoS vulnerability in REXML...