CVE-2014-0191

What it actually does

The xmlParserHandlePEReference function in libxml2 loads external parameter entities irrespective of entity substitution or validation settings, enabling remote attackers to trigger unbounded resource consumption through crafted XML documents.

Why it matters to the business

Attackers can render affected services unavailable by sending specially crafted XML, causing operational downtime and potential loss of availability for dependent applications.

How an attack unfolds

An attacker crafts an XML document containing external parameter entity references and sends it to an endpoint that processes XML using the vulnerable libxml2 parser; the parser resolves the external entities, exhausting server resources and resulting in denial of service.

How to fix it

Upgrade libxml2 to version 2.9.2 or later; where direct upgrade is not feasible, apply vendor patches for Oracle Fusion Middleware or implement input validation to reject external entity references in XML processing.

How to confirm the fix worked

Confirm libxml2 version is 2.9.2 or newer via package inspection or build logs; test by submitting XML containing external parameter entities and verifying that resolution is blocked and no resource exhaustion occurs.

Typical attack path

1. Identify an XML-processing endpoint in the affected product
2. Craft an XML payload containing external parameter entity references
3. Transmit the payload via HTTP or other supported protocol
4. Observe resource exhaustion on the target server

How to detect it

Review web server and application logs for unusually large or malformed XML payloads; correlate with spikes in CPU or memory usage on XML-processing components.

What your security team should do

• Prioritize patching libxml2 to 2.9.2+ across all affected Oracle Fusion Middleware installations
• Implement XML parser hardening to disable external entity resolution as a compensating control
• Monitor for availability degradation on XML-handling services