gsd-2013-5372
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2013-5372", "description": "The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities.", "id": "GSD-2013-5372", "references": [ "https://www.suse.com/security/cve/CVE-2013-5372.html", "https://access.redhat.com/errata/RHSA-2013:1793", "https://access.redhat.com/errata/RHSA-2013:1509", "https://access.redhat.com/errata/RHSA-2013:1508", "https://access.redhat.com/errata/RHSA-2013:1507" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2013-5372" ], "details": "The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities.", "id": "GSD-2013-5372", "modified": "2023-12-13T01:22:21.528230Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "psirt@us.ibm.com", "ID": "CVE-2013-5372", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "IC96473", "refsource": "AIXAPAR", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC96473" }, { "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21655202", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21655202" }, { "name": "RHSA-2013:1508", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-1508.html" }, { "name": "SUSE-SU-2013:1677", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html" }, { "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21655201", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21655201" }, { "name": "ibm-xml4j-cve20135372-dos(86662)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86662" }, { "name": "https://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2013", "refsource": "CONFIRM", "url": "https://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2013" }, { "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21653087", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21653087" }, { "name": "RHSA-2013:1793", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-1793.html" }, { "name": "RHSA-2013:1509", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-1509.html" }, { "name": "RHSA-2013:1507", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-1507.html" }, { "name": "56338", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/56338" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:6.1.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:6.1.0.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:6.1.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:6.1.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:6.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:6.1.0.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:6.1.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:6.1.0.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:6.1.0.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:6.1.0.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:6.1.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:6.1.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:8.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:8.0.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:8.0.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:8.0.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:7.0.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:7.0.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:7.0.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:7.0.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:7.0.:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:7.0.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ibm:websphere_message_broker:7.0.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "psirt@us.ibm.com", "ID": "CVE-2013-5372" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "The XML4J parser in IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.7, and 8.0 before 8.0.0.4 and IBM Integration Bus 9.0 before 9.0.0.1 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document that triggers expansion for many entities." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-399" } ] } ] }, "references": { "reference_data": [ { "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21653087", "refsource": "CONFIRM", "tags": [ "Vendor Advisory" ], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21653087" }, { "name": "IC96473", "refsource": "AIXAPAR", "tags": [], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC96473" }, { "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21655201", "refsource": "CONFIRM", "tags": [], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21655201" }, { "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21655202", "refsource": "CONFIRM", "tags": [], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21655202" }, { "name": "https://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2013", "refsource": "CONFIRM", "tags": [], "url": "https://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2013" }, { "name": "RHSA-2013:1507", "refsource": "REDHAT", "tags": [], "url": "http://rhn.redhat.com/errata/RHSA-2013-1507.html" }, { "name": "SUSE-SU-2013:1677", "refsource": "SUSE", "tags": [], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html" }, { "name": "RHSA-2013:1508", "refsource": "REDHAT", "tags": [], "url": "http://rhn.redhat.com/errata/RHSA-2013-1508.html" }, { "name": "RHSA-2013:1509", "refsource": "REDHAT", "tags": [], "url": "http://rhn.redhat.com/errata/RHSA-2013-1509.html" }, { "name": "RHSA-2013:1793", "refsource": "REDHAT", "tags": [], "url": "http://rhn.redhat.com/errata/RHSA-2013-1793.html" }, { "name": "56338", "refsource": "SECUNIA", "tags": [], "url": "http://secunia.com/advisories/56338" }, { "name": "ibm-xml4j-cve20135372-dos(86662)", "refsource": "XF", "tags": [], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86662" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false } }, "lastModifiedDate": "2017-08-29T01:33Z", "publishedDate": "2013-10-19T10:36Z" } } }
Loading...