CVE-2014-0191

The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware…

published January 21, 2015

CVSS
—
EPSS
8%
Percentile
94.8
In the wild
Unconfirmed
What it is

The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08137 · 94.8th percentile
Published
2015-01-21T02:00Z
EPSS history
Timeline
  • 21 JAN 02:00Z
    The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware…
    cvelistv5