CVE-2013-0340
- State
- Published
- Severity
- Not scored
- Published
- Jan 21, 2014
- Updated
- Oct 14, 2026
- Reserved
- Dec 6, 2012
Description
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
libexpat |
|
References
- [oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansionmailing-list
- [oss-security] 20130413 Re-evaluating expat/libxml2 CVE assignmentsmailing-list
- 90634vdb-entry
- 1028213vdb-entry
- GLSA-201701-21vendor-advisory
- 58233vdb-entry
- https://support.apple.com/kb/HT212805
- https://support.apple.com/kb/HT212804
- https://support.apple.com/kb/HT212807
- https://support.apple.com/kb/HT212819
- https://support.apple.com/kb/HT212814
- https://support.apple.com/kb/HT212815
- 20210921 APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15mailing-list
- 20210921 APPLE-SA-2021-09-20-2 watchOS 8mailing-list
- 20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalinamailing-list
- 20210921 APPLE-SA-2021-09-20-3 tvOS 15mailing-list
- 20210921 APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8mailing-list
- 20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6mailing-list
- [announce] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughsmailing-list
- [openoffice-users] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughsmailing-list
- [oss-security] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughsmailing-list
- 20211027 APPLE-SA-2021-10-26-10 Additional information for APPLE-SA-2021-09-20-2 watchOS 8mailing-list
- 20211027 APPLE-SA-2021-10-26-11 Additional information for APPLE-SA-2021-09-20-3 tvOS 15mailing-list
- 20211027 APPLE-SA-2021-10-26-9 Additional information for APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15mailing-list
- Expat 2.4.0 and 2.4.1 Changelog
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.