Description (CNA)
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| libxml2 / libxml2 | affected 2.11.0 before 2.11.9; affected 2.12.0 before 2.12.9; affected 2.13.0 before 2.13.3 |
CWE
CWE-611
References
- https://gitlab.gnome.org/GNOME/libxml2/-/issues/761
- https://gitlab.gnome.org/GNOME/libxml2/-/commit/1a8932303969907f6572b1b6aac4081c56adb5c6
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.