Vulnerability Details CVE-2014-2742
Isode M-Link before 16.0v7 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 70.6%
CVSS Severity
CVSS v2 Score 7.8
References
- http://openwall.com/lists/oss-security/2014/04/07/7
- http://openwall.com/lists/oss-security/2014/04/09/1
- http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/
- http://openwall.com/lists/oss-security/2014/04/07/7
- http://openwall.com/lists/oss-security/2014/04/09/1
- http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas/
Products affected by CVE-2014-2742
-
cpe:2.3:a:isode:m-link:14.6
-
cpe:2.3:a:isode:m-link:14.6.14
-
cpe:2.3:a:isode:m-link:15.1
-
cpe:2.3:a:isode:m-link:15.1.10
-
cpe:2.3:a:isode:m-link:16.0