PT-2011-3350 · Jabberd2 · Jabberd2

Jan Lieskovsky · CVE-2011-1755 · Publicado 2011-06-21 · Atualizado 2024-02-02

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions jabberd2 versions prior to 2.2.14

Description The issue allows remote attackers to cause a denial of service due to memory and CPU consumption. This is achieved through a crafted XML document containing a large number of nested entity references, which the software does not properly detect during entity expansion.

Recommendations For versions prior to 2.2.14, update to version 2.2.14 or later to resolve the issue.

Correção

XML Entity Expansion

Enumeração de Fraquezas

CWE-776

Identificadores relacionados

CVE-2011-1755

RHSA-2011:0881

RHSA-2011:0882

Produtos afetados

Jabberd2

Referências · 21

• https://nvd.nist.gov/vuln/detail/CVE-2011-1755 · Nota de Segurança
• http://codex.xiaoka.com/svn/jabberd2/tags/jabberd-2.2.14/ChangeLog · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061482.html · Aviso do Fabricante
• http://mail-archive.com/jabberd2%40lists.xiaoka.com/msg01655.html · Nota
• http://redhat.com/support/errata/RHSA-2011-0881.html · Aviso do Fabricante
• http://support.apple.com/kb/HT5002 · Nota
• https://hermes.opensuse.org/messages/9197650 · Aviso do Fabricante
• http://securityfocus.com/bid/48250 · Nota
• https://t.me/cvenotify/69776 · Publicação no Telegram
• http://redhat.com/support/errata/RHSA-2011-0882.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1755 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=700390 · Correção
• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061458.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2011-1755 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061341.html · Aviso do Fabricante