CVE-2011-1755

Published: Jun 21, 2011Modified: Apr 29, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

Affected (8)

Products: Jabberd2: Jabberd2 · Fedoraproject: Fedora · Apple: Mac Os X, Mac Os X Server

1 product

1 product

2 products

Mac Os X Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jabberd2 Jabberd2	Before 2.2.14

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 13
Fedoraproject Fedora	Version 14
Fedoraproject Fedora	Version 15

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Before 10.6.8
Apple Mac Os X	From 10.7.0 to 10.7.2
Apple Mac Os X Server	Before 10.6.8
Apple Mac Os X Server	From 10.7.0 to 10.7.2

Related CWEs

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (32)

http://codex.xiaoka.com/svn/jabberd2/tags/jabberd-2.2.14/ChangeLog

Source: secalert@redhat.com

Broken Link

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Source: secalert@redhat.com

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061341.html

Source: secalert@redhat.com

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061458.html

Source: secalert@redhat.com

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061482.html

Source: secalert@redhat.com

Mailing List

http://secunia.com/advisories/44787

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://secunia.com/advisories/44957

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/45112

Source: secalert@redhat.com

Broken Link

http://support.apple.com/kb/HT5002

Source: secalert@redhat.com

Third Party Advisory

http://www.mail-archive.com/jabberd2%40lists.xiaoka.com/msg01655.html

Source: secalert@redhat.com

Release Notes

http://www.redhat.com/support/errata/RHSA-2011-0881.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2011-0882.html

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/bid/48250

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=700390

Source: secalert@redhat.com

Issue TrackingPatch

https://exchange.xforce.ibmcloud.com/vulnerabilities/67770

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://hermes.opensuse.org/messages/9197650

Source: secalert@redhat.com

Broken Link

http://codex.xiaoka.com/svn/jabberd2/tags/jabberd-2.2.14/ChangeLog

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061341.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061458.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061482.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

http://secunia.com/advisories/44787

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkVendor Advisory

http://secunia.com/advisories/44957

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://secunia.com/advisories/45112

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://support.apple.com/kb/HT5002

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.mail-archive.com/jabberd2%40lists.xiaoka.com/msg01655.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

http://www.redhat.com/support/errata/RHSA-2011-0881.html

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.redhat.com/support/errata/RHSA-2011-0882.html

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.securityfocus.com/bid/48250

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

https://bugzilla.redhat.com/show_bug.cgi?id=700390

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://exchange.xforce.ibmcloud.com/vulnerabilities/67770

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://hermes.opensuse.org/messages/9197650

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.