{"id":"CVE-2013-0338","aliases":["DEBIAN-CVE-2013-0338","DSA-2652-1","EUVD-2013-0350","GHSA-pvmp-h985-7qh3","RHSA-2013:0581","openSUSE-SU-2024:10192-1"],"status":"published","title":"libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU...","description":"libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka \"internal entity expansion\" with linear complexity.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02856,"percentile":0.86834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2013-03-24T00:00:00Z","modified":"2026-09-01T20:03:11Z","fixes":[{"ecosystem":"Debian:12","package":"libxml2","fixed_in":["2.8.0+dfsg1-7+nmu1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml2","fixed_in":["2.8.0+dfsg1-7+nmu1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml2","fixed_in":["2.8.0+dfsg1-7+nmu1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2","fixed_in":["0:2.6.26-2.1.21.el5_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2-debuginfo","fixed_in":["0:2.6.26-2.1.21.el5_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2-devel","fixed_in":["0:2.6.26-2.1.21.el5_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2-python","fixed_in":["0:2.6.26-2.1.21.el5_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-debuginfo","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-python","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-devel","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-static","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-debuginfo","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-python","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-devel","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-static","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-debuginfo","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-devel","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-python","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-static","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-debuginfo","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-devel","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-python","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-static","fixed_in":["0:2.7.6-12.el6_4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0+dfsg1-7+nmu1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0+dfsg1-7+nmu1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0+dfsg1-7+nmu1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.8.dfsg-2+squeeze7"}]}],"versions":["2.7.8.dfsg-2","2.7.8.dfsg-2+squeeze1","2.7.8.dfsg-2+squeeze2","2.7.8.dfsg-2+squeeze3","2.7.8.dfsg-2+squeeze4","2.7.8.dfsg-2+squeeze5","2.7.8.dfsg-2+squeeze6"],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.21.el5_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.21.el5_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.21.el5_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.21.el5_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-12.el6_4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-1.22"}]}],"bundled":32}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"xmlsoft","product":"libxml2"}],"references":[{"url":"http://secunia.com/advisories/52662","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-03/msg00114.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=912400","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-03/msg00112.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=142798889927587\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2013/dsa-2652","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/55568","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-1782-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:056","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0338","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pvmp-h985-7qh3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-0338","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0581","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0581.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0338","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4483","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-0338","description":"libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka \"internal entity expansion\" with linear complexity.","status":"published","published":"2013-04-25T23:00:00Z","modified":"2024-08-06T14:25:09.526Z","updated_at":"2026-11-02T14:34:59.551717Z"}],"euvd":[{"id":"EUVD-2013-0350","description":"libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka \"internal entity expansion\" with linear complexity.","status":"published","published":"2013-04-25T23:00:00Z","modified":"2024-08-06T14:25:09Z","updated_at":"2026-11-03T01:56:45.704567Z"}],"ghsa":[{"id":"GHSA-pvmp-h985-7qh3","title":"libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU...","description":"libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka \"internal entity expansion\" with linear complexity.","status":"published","published":"2022-05-05T02:48:50Z","modified":"2023-02-01T05:01:59Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:49:49.102034Z"}],"nvd":[{"id":"CVE-2013-0338","description":"libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka \"internal entity expansion\" with linear complexity.","status":"published","published":"2013-04-25T23:55:01.5Z","modified":"2026-06-16T23:49:15.48Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:25.704053Z"}],"osv":[{"id":"CVE-2013-0338","description":"libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka \"internal entity expansion\" with linear complexity.","status":"published","published":"2013-04-25T23:55:01Z","modified":"2026-04-10T03:42:39.447936Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-0338","description":"libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka \"internal entity expansion\" with linear complexity.","status":"published","published":"2013-04-25T23:55:01.5Z","modified":"2026-09-01T20:03:11.365109598Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"DSA-2652-1","title":"libxml2 - external entity expansion","status":"published","published":"2013-03-24T00:00:00Z","modified":"2026-03-09T01:22:07.11377Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"openSUSE-SU-2024:10192-1","title":"libxml2-2-2.9.4-1.22 on GA media","description":"These are all security issues fixed in the libxml2-2-2.9.4-1.22 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:48:35.051224Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2013:0581","title":"Red Hat Security Advisory: libxml2 security update","status":"published","published":"2024-09-15T20:38:00Z","modified":"2026-06-26T12:21:44.439383689Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}