Vulnerability Details CVE-2013-1821
lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.076
EPSS Ranking 91.5%
CVSS Severity
CVSS v2 Score 5.0
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702525
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00036.html
- http://rhn.redhat.com/errata/RHSA-2013-0611.html
- http://rhn.redhat.com/errata/RHSA-2013-0612.html
- http://rhn.redhat.com/errata/RHSA-2013-1028.html
- http://rhn.redhat.com/errata/RHSA-2013-1147.html
- http://secunia.com/advisories/52783
- http://secunia.com/advisories/52902
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=39384
- http://www.debian.org/security/2013/dsa-2738
- http://www.debian.org/security/2013/dsa-2809
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:124
- http://www.openwall.com/lists/oss-security/2013/03/06/5
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/
- http://www.securityfocus.com/bid/58141
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.426862
- http://www.ubuntu.com/usn/USN-1780-1
- https://bugzilla.redhat.com/show_bug.cgi?id=914716
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0092
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702525
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00036.html
- http://rhn.redhat.com/errata/RHSA-2013-0611.html
- http://rhn.redhat.com/errata/RHSA-2013-0612.html
- http://rhn.redhat.com/errata/RHSA-2013-1028.html
- http://rhn.redhat.com/errata/RHSA-2013-1147.html
- http://secunia.com/advisories/52783
- http://secunia.com/advisories/52902
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=39384
- http://www.debian.org/security/2013/dsa-2738
- http://www.debian.org/security/2013/dsa-2809
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:124
- http://www.openwall.com/lists/oss-security/2013/03/06/5
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/
- http://www.securityfocus.com/bid/58141
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.426862
- http://www.ubuntu.com/usn/USN-1780-1
- https://bugzilla.redhat.com/show_bug.cgi?id=914716
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0092
Products affected by CVE-2013-1821
-
cpe:2.3:a:ruby-lang:ruby:1.9
-
cpe:2.3:a:ruby-lang:ruby:1.9.1
-
cpe:2.3:a:ruby-lang:ruby:1.9.2
-
cpe:2.3:a:ruby-lang:ruby:1.9.3
-
cpe:2.3:a:ruby-lang:ruby:2.0
-
cpe:2.3:a:ruby-lang:ruby:2.0.0