Published: 12/05/2015 Updated: 29/04/2020

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

The _clone function in XML::LibXML prior to 2.0119 does not properly set the expand_entities option, which allows remote malicious users to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xml-libxml project xml-libxml
debian debian linux 7.0
canonical ubuntu linux 14.04
canonical ubuntu linux 15.04
canonical ubuntu linux 12.04
canonical ubuntu linux 14.10
debian debian linux 8.0
fedoraproject fedora 21
fedoraproject fedora 20
opensuse opensuse 13.2
opensuse opensuse 13.1

Debian Bug report logs - #783443 libxml-libxml-perl: XEE vulnerability; expand_entities set to 0 is not preserved after a _clone() call (CVE-2015-3451) Package: src:libxml-libxml-perl; Maintainer for src:libxml-libxml-perl is Debian Perl Group <pkg-perl-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso & ...

XML::LibXML could be made to expose sensitive information ...

The _clone function in XML::LibXML before 20119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function ...

CWE-611 https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30/raw/http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes http://www.ubuntu.com/usn/USN-2592-1 http://www.debian.org/security/2015/dsa-3243 http://www.openwall.com/lists/oss-security/2015/04/30/1 http://www.openwall.com/lists/oss-security/2015/04/25/2 http://www.securityfocus.com/bid/74333 http://lists.opensuse.org/opensuse-updates/2015-09/msg00006.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:231 http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157740.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157448.html http://advisories.mageia.org/MGASA-2015-0199.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783443 https://usn.ubuntu.com/2592-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-3451

CVE-2015-3451

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect