CVE-2013-0340

EUVD-2013-0352
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 20%
Affected Products (NVD)
VendorProductVersion
libexpat_projectlibexpat
𝑥
< 2.4.0
pythonpython
3.6.0 ≤
𝑥
< 3.6.15
pythonpython
3.7.0 ≤
𝑥
< 3.7.12
pythonpython
3.8.0 ≤
𝑥
< 3.8.12
pythonpython
3.9.0 ≤
𝑥
< 3.9.7
appleipados
𝑥
< 14.8
appleiphone_os
𝑥
< 14.8
applemacos
𝑥
< 11.6
appletvos
𝑥
< 15.0
applewatchos
𝑥
< 8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
expat
bookworm
2.5.0-1
fixed
bookworm (security)
2.5.0-1+deb12u1
fixed
bullseye
unimportant
bullseye (security)
unimportant
sid
2.6.3-2
fixed
trixie
2.6.3-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
apache2
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
apr-util
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
audacity
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
ayttm
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
cableswig
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
cadaver
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
celementtree
hardy
ignored
lucid
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
cmake
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
coin3
hardy
dne
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
expat
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
gdcm
hardy
dne
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
ghostscript
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
grmonitor
hardy
ignored
lucid
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
insighttoolkit
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
kompozer
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
dne
raring
dne
libparagui1.1
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
dne
raring
dne
matanza
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
paraview
hardy
dne
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
poco
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
python-xml
hardy
ignored
lucid
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
python2.4
hardy
ignored
lucid
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
python2.5
hardy
ignored
lucid
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
python2.6
hardy
dne
lucid
ignored
oneiric
ignored
precise
dne
quantal
dne
raring
dne
simgear
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
sitecopy
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
smart
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
swish-e
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
tdom
hardy
dne
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
texlive-bin
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
tla
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
vnc4
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
vtk
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
w3c-libwww
hardy
ignored
lucid
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
wbxml2
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
wxwidgets2.6
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
dne
raring
dne
wxwidgets2.8
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
wxwindows2.4
hardy
ignored
lucid
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
xmlrpc-c
hardy
ignored
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
xotcl
hardy
dne
lucid
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
xulrunner
hardy
ignored
lucid
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
References