Red Hat Bugzilla – Bug 1000109
CVE-2013-0340 expat: internal entity expansion
Last modified: 2015-07-31 03:09:56 EDT
As reported on oss-security :
So here are the CVE's for the two big ones, libxml2 and expat. Both
are affected by the expansion of internal entities (which can be used
to consume resources) and external entities (which can cause a denial
of service against other services, be used to port scan, etc.).
To be clear:
Internal entity expansion refers to the exponential/quadratic/fast
linear expansion of XML entities, e.g.:
<!DOCTYPE xmlbomb [
<!ENTITY a "1234567890" >
<!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;">
<!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;">
<!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;">
<!DOCTYPE bomb [
<!ENTITY a "xxxxxxx... a couple of ten thousand chars">
Which causes resources to be consumed
Please use CVE-2013-0340 for expat internal entity expansion
Applications linked with expat can mitigate this issue, by calling the XML_SetEntityDeclHandler() function with the name of an alternative function that can handle entities more safely.
Since API levels mitigations are in place, closing this as wontfix.