What’s Vulnerable › Vulnerabilities

CVE-2013-0339

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-01-21 · updated 2026-06-16
• Weakness: CWE-264

Description

libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.

Affected products

• Canonical Ubuntu Linux: 10.04, 12.04, 12.10, 13.04
• Debian Linux: 6.0, 7.0
• SUSE Linux Enterprise Server: 10-sp4
• xmlsoft libxml2: through 2.9.1; 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.8.0 (+121)

References

• http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html
• http://openwall.com/lists/oss-security/2013/02/21/24
• http://openwall.com/lists/oss-security/2013/02/22/3
• http://seclists.org/oss-sec/2013/q4/182
• http://seclists.org/oss-sec/2013/q4/184
• http://seclists.org/oss-sec/2013/q4/188
• http://secunia.com/advisories/52662
• http://secunia.com/advisories/54172
• http://secunia.com/advisories/55568
• http://www.debian.org/security/2013/dsa-2652
• http://www.openwall.com/lists/oss-security/2013/04/12/6
• http://www.ubuntu.com/usn/USN-1904-1

Get alerted when CVE-2013-0339 or the next vulnerability affects your stack