CVE-2014-3660
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity...
CVE-2014-3660 is a medium vulnerability (CVSS 5.0) in Xmlsoft Libxml2, published October 16, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.78%, the 89th percentile. Fixed in libxml2 2.9.2+dfsg1-1.
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
Exploit likelihood
What each source reports
NVD Score used
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
- Record
CVE-2014-3660- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
- Record
CVE-2014-3660- Updated
- 2026-11-02
EUVDEUVD-2014-3613 No score
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
- Record
EUVD-2014-3613- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xrph-4qjj-gj25 No score
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity...
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
- Record
GHSA-xrph-4qjj-gj25- Updated
- 2026-11-02
OSV No score
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
- Record
CVE-2014-3660- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3660 No score
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
- Record
DEBIAN-CVE-2014-3660- Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2014-0418 No score
Updated libxml2 packages fix security vulnerability
A denial of service flaw was found in libxml2, a library providing support to read, modify and write XML and HTML files. A remote attacker could provide a specially crafted XML file that, when processed by an application using libxml2, would lead to excessive CPU consumption (denial of service) based on excessive entity substitutions, even if entity substitution was disabled, which is the parser default behavior (CVE-2014-3660).
- Record
MGASA-2014-0418- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10192-1 No score
libxml2-2-2.9.4-1.22 on GA media
These are all security issues fixed in the libxml2-2-2.9.4-1.22 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10192-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3660 No score
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
- Record
UBUNTU-CVE-2014-3660- Updated
- 2026-11-02
OSVUSN-2389-1 No score
libxml2 vulnerability
It was discovered that libxml2 would incorrectly perform entity substitution even when requested not to. If a user or automated system were tricked into opening a specially crafted document, an attacker could possibly cause resource consumption, resulting in a denial of service.
- Record
USN-2389-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libxml2Debian:12 |
before 2.9.2+dfsg1-1 | 2.9.2+dfsg1-1 |
libxml2Debian:13 |
before 2.9.2+dfsg1-1 | 2.9.2+dfsg1-1 |
libxml2Debian:14 |
before 2.9.2+dfsg1-1 | 2.9.2+dfsg1-1 |
libxml2Debian:6.0 |
before 2.7.8.dfsg-2+squeeze11, plus listed versions 2.7.8.dfsg-22.7.8.dfsg-2+squeeze12.7.8.dfsg-2+squeeze102.7.8.dfsg-2+squeeze22.7.8.dfsg-2+squeeze3 Show 6 moreShow less2.7.8.dfsg-2+squeeze42.7.8.dfsg-2+squeeze52.7.8.dfsg-2+squeeze62.7.8.dfsg-2+squeeze72.7.8.dfsg-2+squeeze82.7.8.dfsg-2+squeeze9 |
2.7.8.dfsg-2+squeeze11 |
libxml2Debian:6.0 |
before 2.7.8.dfsg-2+squeeze10, plus listed versions 2.7.8.dfsg-22.7.8.dfsg-2+squeeze12.7.8.dfsg-2+squeeze22.7.8.dfsg-2+squeeze32.7.8.dfsg-2+squeeze4 Show 5 moreShow less2.7.8.dfsg-2+squeeze52.7.8.dfsg-2+squeeze62.7.8.dfsg-2+squeeze72.7.8.dfsg-2+squeeze82.7.8.dfsg-2+squeeze9 |
2.7.8.dfsg-2+squeeze10 |
libxml2Debian:7 |
before 2.8.0+dfsg1-7+wheezy3, plus listed versions 2.8.0+dfsg1-7+nmu12.8.0+dfsg1-7+nmu22.8.0+dfsg1-7+nmu32.8.0+dfsg1-7+wheezy12.8.0+dfsg1-7+wheezy2 |
2.8.0+dfsg1-7+wheezy3 |
libxml2Debian:7 |
before 2.8.0+dfsg1-7+wheezy2, plus listed versions 2.8.0+dfsg1-7+nmu12.8.0+dfsg1-7+nmu22.8.0+dfsg1-7+nmu32.8.0+dfsg1-7+wheezy1 |
2.8.0+dfsg1-7+wheezy2 |
libxml2Mageia:3 |
before 2.9.0-5.4.mga3 | 2.9.0-5.4.mga3 |
libxml2Mageia:4 |
before 2.9.1-2.2.mga4 | 2.9.1-2.2.mga4 |
libxml2Red Hat:enterprise_linux:6::client |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
Show 51 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libxml2-debuginfoRed Hat:enterprise_linux:6::client |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-pythonRed Hat:enterprise_linux:6::client |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-develRed Hat:enterprise_linux:6::client |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-staticRed Hat:enterprise_linux:6::client |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2Red Hat:enterprise_linux:6::computenode |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-pythonRed Hat:enterprise_linux:6::computenode |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-develRed Hat:enterprise_linux:6::computenode |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-staticRed Hat:enterprise_linux:6::computenode |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2Red Hat:enterprise_linux:6::server |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-debuginfoRed Hat:enterprise_linux:6::server |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-develRed Hat:enterprise_linux:6::server |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-pythonRed Hat:enterprise_linux:6::server |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-staticRed Hat:enterprise_linux:6::server |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2Red Hat:enterprise_linux:6::workstation |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-develRed Hat:enterprise_linux:6::workstation |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-pythonRed Hat:enterprise_linux:6::workstation |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2-staticRed Hat:enterprise_linux:6::workstation |
before 0:2.7.6-17.el6_6.1 | 0:2.7.6-17.el6_6.1 |
libxml2Red Hat:enterprise_linux:7::client |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-debuginfoRed Hat:enterprise_linux:7::client |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-pythonRed Hat:enterprise_linux:7::client |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-develRed Hat:enterprise_linux:7::client |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-staticRed Hat:enterprise_linux:7::client |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2Red Hat:enterprise_linux:7::computenode |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-pythonRed Hat:enterprise_linux:7::computenode |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-develRed Hat:enterprise_linux:7::computenode |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-staticRed Hat:enterprise_linux:7::computenode |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2Red Hat:enterprise_linux:7::server |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-debuginfoRed Hat:enterprise_linux:7::server |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-develRed Hat:enterprise_linux:7::server |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-pythonRed Hat:enterprise_linux:7::server |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-staticRed Hat:enterprise_linux:7::server |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2Red Hat:enterprise_linux:7::workstation |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-develRed Hat:enterprise_linux:7::workstation |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-pythonRed Hat:enterprise_linux:7::workstation |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2-staticRed Hat:enterprise_linux:7::workstation |
before 0:2.9.1-5.el7_0.1 | 0:2.9.1-5.el7_0.1 |
libxml2Red Hat:enterprise_linux:5::client |
before 0:2.6.26-2.1.25.el5_11 | 0:2.6.26-2.1.25.el5_11 |
libxml2-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.6.26-2.1.25.el5_11 | 0:2.6.26-2.1.25.el5_11 |
libxml2-pythonRed Hat:enterprise_linux:5::client |
before 0:2.6.26-2.1.25.el5_11 | 0:2.6.26-2.1.25.el5_11 |
libxml2Red Hat:enterprise_linux:5::client_workstation |
before 0:2.6.26-2.1.25.el5_11 | 0:2.6.26-2.1.25.el5_11 |
libxml2-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:2.6.26-2.1.25.el5_11 | 0:2.6.26-2.1.25.el5_11 |
libxml2-develRed Hat:enterprise_linux:5::client_workstation |
before 0:2.6.26-2.1.25.el5_11 | 0:2.6.26-2.1.25.el5_11 |
libxml2Red Hat:enterprise_linux:5::server |
before 0:2.6.26-2.1.25.el5_11 | 0:2.6.26-2.1.25.el5_11 |
libxml2-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.6.26-2.1.25.el5_11 | 0:2.6.26-2.1.25.el5_11 |
libxml2-develRed Hat:enterprise_linux:5::server |
before 0:2.6.26-2.1.25.el5_11 | 0:2.6.26-2.1.25.el5_11 |
libxml2-pythonRed Hat:enterprise_linux:5::server |
before 0:2.6.26-2.1.25.el5_11 | 0:2.6.26-2.1.25.el5_11 |
libxml2Ubuntu:14.04:LTS |
before 2.9.1+dfsg1-3ubuntu4.4, plus listed versions 2.9.1+dfsg1-3ubuntu22.9.1+dfsg1-3ubuntu32.9.1+dfsg1-3ubuntu42.9.1+dfsg1-3ubuntu4.12.9.1+dfsg1-3ubuntu4.22.9.1+dfsg1-3ubuntu4.3 |
2.9.1+dfsg1-3ubuntu4.4 |
libxml2openSUSE:Tumbleweed |
before 2.9.4-1.22 | 2.9.4-1.22 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
secunia.com/advisories/59903
ncsc.nl/actueel/nieuwsberichten/kwetsbaarheid-ontdekt-in-libxml2.html
debian.org/security/2014/dsa-3057
support.apple.com/kb/HT205030
securityfocus.com/bid/70644
Show 63 moreShow less
lists.opensuse.org/opensuse-updates/2014-10/msg00034.html
bugzilla.redhat.com/attachment.cgi?id=944444&action=diff
ubuntu.com/usn/USN-2389-1
lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
openwall.com/lists/oss-security/2014/10/17/7
mandriva.com/security/advisories?name=MDVSA-2014:244
rhn.redhat.com/errata/RHSA-2014-1655.html
kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
nvd.nist.gov/vuln/detail/CVE-2014-3660
github.com/advisories/GHSA-xrph-4qjj-gj25
security-tracker.debian.org/tracker/CVE-2014-3660
advisories.mageia.org/MGASA-2014-0418.html
bugs.mageia.org/show_bug.cgi?id=14315
access.redhat.com/errata/RHSA-2014:1655
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1655.json
cve.org/CVERecord?id=CVE-2014-3660
ubuntu.com/security/CVE-2014-3660
suse.com/security/cve/CVE-2008-4225