CVE-2013-0340
NoneCVSS
—
EPSS
19.4%
Published
Jan 21, 2014
CISA due date
—
The record
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | expat | 0 | No fix |
| Debian:11 | expat | 0 | No fix |
| Debian:11 | libxmltok | 0 | No fix |
| Debian:12 | expat | 0 | 2.4.1-2 |
| Debian:12 | libxmltok | 0 | No fix |
| Debian:13 | expat | 0 | 2.4.1-2 |
| openSUSE:Tumbleweed | expat | 0 | 2.4.1-1.2 |
| openSUSE:Tumbleweed | python38 | 0 | 3.8.12-1.2 |
Related vulnerabilities
- CVE-2024-28757 libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use… Also affects expat
- CVE-2009-3560 The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the… Also affects expat
- CVE-2009-3720 The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in… Also affects expat
- CVE-2024-50602 An issue was discovered in libexpat before 2.6.4. Also affects expat
- CVE-2024-45491 An issue was discovered in libexpat before 2.6.3. Also affects expat
- CVE-2024-45492 An issue was discovered in libexpat before 2.6.3. Also affects expat
- CVE-2024-45490 An issue was discovered in libexpat before 2.6.3. Also affects expat
- CVE-2017-9233 XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser… Also affects expat