CVE-2003-1564

Published: 31 December 2003

libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."

Priority

Status

Package	Release	Status
libxml2 Launchpad, Ubuntu, Debian	hardy	Not vulnerable (2.6.31.dfsg-2ubuntu1)
	lucid	Not vulnerable
	natty	Not vulnerable
	oneiric	Not vulnerable
	precise	Not vulnerable
	upstream	Released (2.5.0)

References

https://www.cve.org/CVERecord?id=CVE-2003-1564
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.