Veracode Vulnerability DatabaseVERACODE:4485Denial Of Service (DoS) Through Infinite Loop
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
Expat is vulnerable to denial of service (DoS) attacks. A malicious user can cause the parser to enter an infinite loop by passing an XML document with `` in it.
| CPE | Name | Operator | Version |
|---|---|---|---|
| expat | eq | 2.1 | |
| libexpat.so | le | 1.7.0 | |
| expat | eq | 1.95.5__6-2.1.0__10.el7_3 | |
| expat:trusty | eq | 2.1.0-4ubuntu1 |
References
www.debian.org/security/2017/dsa-3898
www.openwall.com/lists/oss-security/2017/06/17/7
www.securityfocus.com/bid/99276
www.securitytracker.com/id/1039427
github.com/libexpat/libexpat/blob/master/expat/Changes
libexpat.github.io/doc/cve-2017-9233/
lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
security-tracker.debian.org/tracker/CVE-2017-9233
support.apple.com/HT208112
support.apple.com/HT208113
support.apple.com/HT208115
support.apple.com/HT208144
support.f5.com/csp/article/K03244804
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P