CVE-2015-3451

Published: May 12, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.

Affected (11)

Products: Xml Libxml Project: Xml Libxml · Canonical: Ubuntu Linux · Debian: Debian Linux · +2 more

Show all products

Xml Libxml Project: Xml Libxml · Canonical: Ubuntu Linux · Debian: Debian Linux · Fedoraproject: Fedora · Opensuse: Opensuse

Xml Libxml Project

1 product

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Xml Libxml Project Xml Libxml	Up to 2.0118

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 14.10
Canonical Ubuntu Linux	Version 15.04
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 20
Fedoraproject Fedora	Version 21

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 13.1
Opensuse Opensuse	Version 13.2

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (24)

http://advisories.mageia.org/MGASA-2015-0199.html

Source: cve@mitre.org

Third Party Advisory

http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes

Source: cve@mitre.org

Release NotesThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157448.html

Source: cve@mitre.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157740.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-09/msg00006.html

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2015/dsa-3243

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2015:231

Source: cve@mitre.org

Broken Link

http://www.openwall.com/lists/oss-security/2015/04/25/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2015/04/30/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/74333

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2592-1

Source: cve@mitre.org

Third Party Advisory

https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30/raw/

Source: cve@mitre.org

Vendor Advisory

http://advisories.mageia.org/MGASA-2015-0199.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/Changes

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157448.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157740.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-09/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2015/dsa-3243

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2015:231

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

http://www.openwall.com/lists/oss-security/2015/04/25/2

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2015/04/30/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/74333

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2592-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30/raw/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.