{"id":"CVE-2014-3660","aliases":["DEBIAN-CVE-2014-3660","DLA-151-1","DLA-80-1","DSA-2978-2","DSA-3057-1","EUVD-2014-3613","GHSA-xrph-4qjj-gj25","MGASA-2014-0418","RHSA-2014:1655","RHSA-2014:1885","UBUNTU-CVE-2014-3660","USN-2389-1","openSUSE-SU-2024:10192-1"],"status":"published","title":"parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity...","description":"parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the \"billion laughs\" attack.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03782,"percentile":0.90034,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2014-10-16T00:00:00Z","modified":"2026-10-23T15:47:39Z","fixes":[{"ecosystem":"Debian:12","package":"libxml2","fixed_in":["2.9.2+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml2","fixed_in":["2.9.2+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml2","fixed_in":["2.9.2+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"libxml2","fixed_in":["2.7.8.dfsg-2+squeeze10"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"libxml2","fixed_in":["2.8.0+dfsg1-7+wheezy2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"libxml2","fixed_in":["2.9.0-5.4.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"libxml2","fixed_in":["2.9.1-2.2.mga4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-debuginfo","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-python","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-devel","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-static","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-debuginfo","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-python","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-devel","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-static","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-debuginfo","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-devel","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-python","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-static","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-debuginfo","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-devel","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-python","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-static","fixed_in":["0:2.7.6-17.el6_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-debuginfo","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-python","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-devel","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-static","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-debuginfo","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-python","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-devel","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-static","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-debuginfo","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-devel","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-python","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-static","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-debuginfo","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-devel","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-python","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-static","fixed_in":["0:2.9.1-5.el7_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"libxml2","fixed_in":["0:2.6.26-2.1.25.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"libxml2-debuginfo","fixed_in":["0:2.6.26-2.1.25.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"libxml2-python","fixed_in":["0:2.6.26-2.1.25.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"libxml2","fixed_in":["0:2.6.26-2.1.25.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"libxml2-debuginfo","fixed_in":["0:2.6.26-2.1.25.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"libxml2-devel","fixed_in":["0:2.6.26-2.1.25.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2","fixed_in":["0:2.6.26-2.1.25.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2-debuginfo","fixed_in":["0:2.6.26-2.1.25.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2-devel","fixed_in":["0:2.6.26-2.1.25.el5_11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2-python","fixed_in":["0:2.6.26-2.1.25.el5_11"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","fixed_in":["2.9.1+dfsg1-3ubuntu4.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.2+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.8.dfsg-2+squeeze11"}]}],"versions":["2.7.8.dfsg-2","2.7.8.dfsg-2+squeeze1","2.7.8.dfsg-2+squeeze10","2.7.8.dfsg-2+squeeze2","2.7.8.dfsg-2+squeeze3","2.7.8.dfsg-2+squeeze4","2.7.8.dfsg-2+squeeze5","2.7.8.dfsg-2+squeeze6","2.7.8.dfsg-2+squeeze7","2.7.8.dfsg-2+squeeze8","2.7.8.dfsg-2+squeeze9"],"bundled":2},{"source":"osv","ecosystem":"Debian:6.0","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.8.dfsg-2+squeeze10"}]}],"versions":["2.7.8.dfsg-2","2.7.8.dfsg-2+squeeze1","2.7.8.dfsg-2+squeeze2","2.7.8.dfsg-2+squeeze3","2.7.8.dfsg-2+squeeze4","2.7.8.dfsg-2+squeeze5","2.7.8.dfsg-2+squeeze6","2.7.8.dfsg-2+squeeze7","2.7.8.dfsg-2+squeeze8","2.7.8.dfsg-2+squeeze9"]},{"source":"osv","ecosystem":"Debian:7","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0+dfsg1-7+wheezy3"}]}],"versions":["2.8.0+dfsg1-7+nmu1","2.8.0+dfsg1-7+nmu2","2.8.0+dfsg1-7+nmu3","2.8.0+dfsg1-7+wheezy1","2.8.0+dfsg1-7+wheezy2"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0+dfsg1-7+wheezy2"}]}],"versions":["2.8.0+dfsg1-7+nmu1","2.8.0+dfsg1-7+nmu2","2.8.0+dfsg1-7+nmu3","2.8.0+dfsg1-7+wheezy1"]},{"source":"osv","ecosystem":"Mageia:3","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-5.4.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-2.2.mga4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-17.el6_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libxml2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.9.1-5.el7_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.25.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.25.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.25.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.25.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.25.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.25.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.25.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.25.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.25.el5_11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"libxml2-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.26-2.1.25.el5_11"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.4"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1+dfsg1-3ubuntu4.4"}]}],"versions":["2.9.1+dfsg1-3ubuntu2","2.9.1+dfsg1-3ubuntu3","2.9.1+dfsg1-3ubuntu4","2.9.1+dfsg1-3ubuntu4.1","2.9.1+dfsg1-3ubuntu4.2","2.9.1+dfsg1-3ubuntu4.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.4-1.22"}]}],"bundled":32}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"xmlsoft","product":"libxml2"}],"references":[{"url":"http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/59903","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://www.ncsc.nl/actueel/nieuwsberichten/kwetsbaarheid-ontdekt-in-libxml2.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-3057","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://support.apple.com/kb/HT205030","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/70644","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-10/msg00034.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/attachment.cgi?id=944444\u0026action=diff","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"http://secunia.com/advisories/61966","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/61965","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2389-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/10/17/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:244","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1655.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-1885.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1149084","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/61991","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10705","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://support.apple.com/kb/HT205031","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3660","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xrph-4qjj-gj25"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3660","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0418.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14315","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-1655.html","tags":["web","report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1655","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1655.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3660","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3660","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1885","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1885.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3660","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2389-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8242","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4483","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3660","description":"parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the \"billion laughs\" attack.","status":"published","published":"2014-11-04T16:00:00Z","modified":"2024-08-06T10:50:17.928Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-3613","description":"parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the \"billion laughs\" attack.","status":"published","published":"2014-11-04T16:00:00Z","modified":"2024-08-06T10:50:17Z","updated_at":"2026-11-03T01:57:09.905604Z"}],"ghsa":[{"id":"GHSA-xrph-4qjj-gj25","title":"parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity...","description":"parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the \"billion laughs\" attack.","status":"published","published":"2022-05-17T03:22:58Z","modified":"2023-01-27T05:08:04Z","updated_at":"2026-11-02T14:43:14.514072Z"}],"nvd":[{"id":"CVE-2014-3660","description":"parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the \"billion laughs\" attack.","status":"published","published":"2014-11-04T16:55:06.043Z","modified":"2026-06-17T00:08:42.133Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CVE-2014-3660","description":"parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the \"billion laughs\" attack.","status":"published","published":"2014-11-04T16:55:06Z","modified":"2026-04-16T06:21:05.210512123Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3660","description":"parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the \"billion laughs\" attack.","status":"published","published":"2014-11-04T16:55:06.043Z","modified":"2026-10-23T15:47:39.616729722Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DLA-151-1","title":"libxml2 - security update","status":"published","published":"2015-02-07T00:00:00Z","modified":"2026-03-09T01:19:40.855307Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-80-1","title":"libxml2 - security update","status":"published","published":"2014-10-29T00:00:00Z","modified":"2026-03-09T02:11:30.91076Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-2978-2","title":"libxml2 - security update","status":"published","published":"2015-02-06T00:00:00Z","modified":"2026-03-09T01:21:54.943686Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"DSA-3057-1","title":"libxml2 - security update","status":"published","published":"2014-10-26T00:00:00Z","modified":"2026-03-09T01:18:24.178388Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0418","title":"Updated libxml2 packages fix security vulnerability","description":"A denial of service flaw was found in libxml2, a library providing support\nto read, modify and write XML and HTML files. A remote attacker could\nprovide a specially crafted XML file that, when processed by an application\nusing libxml2, would lead to excessive CPU consumption (denial of service)\nbased on excessive entity substitutions, even if entity substitution was\ndisabled, which is the parser default behavior (CVE-2014-3660).\n","status":"published","published":"2014-10-23T13:27:57Z","modified":"2026-04-16T06:24:41.467478104Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10192-1","title":"libxml2-2-2.9.4-1.22 on GA media","description":"These are all security issues fixed in the libxml2-2-2.9.4-1.22 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:48:35.051224Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2014:1655","title":"Red Hat Security Advisory: libxml2 security update","status":"published","published":"2024-09-15T22:05:42Z","modified":"2026-06-26T12:21:47.199340911Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1885","title":"Red Hat Security Advisory: libxml2 security update","status":"published","published":"2024-09-15T22:05:48Z","modified":"2026-06-26T12:21:47.882625398Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"UBUNTU-CVE-2014-3660","description":"parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the \"billion laughs\" attack.","status":"published","published":"2014-10-16T00:00:00Z","modified":"2026-04-22T09:42:17.560548Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2389-1","title":"libxml2 vulnerability","description":"It was discovered that libxml2 would incorrectly perform entity\nsubstitution even when requested not to. If a user or automated system were\ntricked into opening a specially crafted document, an attacker could\npossibly cause resource consumption, resulting in a denial of service.\n","status":"published","published":"2014-10-27T13:08:20Z","modified":"2026-04-22T09:03:47.151668Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}