CVE-2014-3660

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-11-04 · updated 2026-06-17

Description

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.

Affected products

macOS: through 10.10.4
Canonical Ubuntu Linux: 10.04, 12.04, 14.04
Debian Linux: 7.0
Red Hat Enterprise Linux: 5.0
xmlsoft libxml2: through 2.9.1; 2.0.0, 2.1.0, 2.1.1, 2.2.0, 2.2.0-beta, 2.2.1 (+103)

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html
http://lists.opensuse.org/opensuse-updates/2014-10/msg00034.html
http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html
http://rhn.redhat.com/errata/RHSA-2014-1655.html
http://rhn.redhat.com/errata/RHSA-2014-1885.html
http://secunia.com/advisories/59903
http://secunia.com/advisories/61965
http://secunia.com/advisories/61966
http://secunia.com/advisories/61991
http://www.debian.org/security/2014/dsa-3057

Get alerted when CVE-2014-3660 or the next vulnerability affects your stack