PT-2011-3350 · Jabberd2 · Jabberd2

Jan Lieskovsky · Published 2011-06-21 · Updated 2024-02-02 · CVE-2011-1755

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions jabberd2 versions prior to 2.2.14

Description The issue allows remote attackers to cause a denial of service due to memory and CPU consumption. This is achieved through a crafted XML document containing a large number of nested entity references, which the software does not properly detect during entity expansion.

Recommendations For versions prior to 2.2.14, update to version 2.2.14 or later to resolve the issue.

Fix

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

CVE-2011-1755

RHSA-2011:0881

RHSA-2011:0882

Affected Products

Jabberd2

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2011-1755 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061482.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0881.html · Vendor Advisory
• https://hermes.opensuse.org/messages/9197650 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0882.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1755 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=700390 · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061458.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-1755 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061341.html · Vendor Advisory
• http://secunia.com/advisories/44787 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-1755 · Vendor Advisory
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html · Vendor Advisory
• http://codex.xiaoka.com/svn/jabberd2/tags/jabberd-2.2.14/ChangeLog · Note
• http://mail-archive.com/jabberd2%40lists.xiaoka.com/msg01655.html · Note