As reported on oss-security [1]: So here are the CVE's for the two big ones, libxml2 and expat. Both are affected by the expansion of internal entities (which can be used to consume resources) and external entities (which can cause a denial of service against other services, be used to port scan, etc.). To be clear: ==================== Internal entity expansion refers to the exponential/quadratic/fast linear expansion of XML entities, e.g.: ==================== <!DOCTYPE xmlbomb [ <!ENTITY a "1234567890" > <!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;"> <!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;"> <!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;"> ]> <bomb>&d;</bomb> or <!DOCTYPE bomb [ <!ENTITY a "xxxxxxx... a couple of ten thousand chars"> ]> <bomb>&a;&a;&a;... repeat</bomb> Which causes resources to be consumed ... Please use CVE-2013-0340 for expat internal entity expansion [1] http://www.openwall.com/lists/oss-security/2013/02/22/4
Applications linked with expat can mitigate this issue, by calling the XML_SetEntityDeclHandler() function with the name of an alternative function that can handle entities more safely. Since API levels mitigations are in place, closing this as wontfix.