CVE-2013-6460 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	6.5 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
redhat	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 84%

Vendor	Product	Version
nokogiri	nokogiri	1.5.0 ≤ 𝑥 < 1.5.11
nokogiri	nokogiri	1.6.0 ≤ 𝑥 < 1.6.1
debian	debian_linux	8.0
debian	debian_linux	9.0
debian	debian_linux	10.0
redhat	cloudforms_management_engine	5.0
redhat	openstack	3.0
redhat	openstack	4.0
redhat	satellite	6.0
redhat	subscription_asset_manager	-
redhat	enterprise_mrg	2.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

ruby-nokogiri

bullseye	1.11.1+dfsg-2 fixed
bullseye (security)	1.11.1+dfsg-2+deb11u1 fixed
bookworm	1.13.10+dfsg-2 fixed
sid	1.16.4+dfsg-1 fixed
trixie	1.16.4+dfsg-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

libnokogiri-ruby

saucy	dne
raring	dne
quantal	dne
precise	dne
lucid	not-affected

ruby-nokogiri

saucy	not-affected
raring	not-affected
quantal	not-affected
precise	not-affected
lucid	dne

Known Exploits!

Common Weakness Enumeration

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The software uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References

http://www.openwall.com/lists/oss-security/2013/12/27/2

http://www.securityfocus.com/bid/64513

https://access.redhat.com/security/cve/cve-2013-6460

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460

https://exchange.xforce.ibmcloud.com/vulnerabilities/90058

https://security-tracker.debian.org/tracker/CVE-2013-6460

http://www.openwall.com/lists/oss-security/2013/12/27/2

http://www.securityfocus.com/bid/64513

https://access.redhat.com/security/cve/cve-2013-6460

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460

https://exchange.xforce.ibmcloud.com/vulnerabilities/90058

https://security-tracker.debian.org/tracker/CVE-2013-6460