CVE-2014-3660

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion
even when entity substitution has been disabled, which allows
context-dependent attackers to cause a denial of service (CPU consumption)
via a crafted XML document containing a large number of nested entity
references, a variant of the “billion laughs” attack.

Bugs

• <https://bugzilla.redhat.com/show_bug.cgi?id=1149084&gt;