Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2013-1864

Date: May 23, 2014

The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references, aka a "billion laughs attack."

Severity Score

Related Resources (12)

http://www.securityfocus.com/bid/58520
http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099553.html
http://osvdb.org/91439
http://secunia.com/advisories/52659
https://access.redhat.com/security/cve/CVE-2013-1864
http://sourceforge.net/p/opalvoip/code/28856
https://exchange.xforce.ibmcloud.com/vulnerabilities/82885
https://www.suse.com/support/update/announcement/2014/suse-su-20140237-1.html
https://nvd.nist.gov/vuln/detail/CVE-2013-1864
http://www.ekiga.org/news/2013-02-21/ekiga-4.0.1-stable-available
http://seclists.org/oss-sec/2013/q1/674
https://www.mend.io/vulnerability-database/CVE-2013-1864

Severity Score

Weakness Type (CWE)

Buffer Errors

CWE-119

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): LOW

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us