CVE-2015-1819 Nokogiri vulnerable to libxml XML Entity Expansion
Remote attackers can cause denial of service via memory consumption in libxml using crafted XML data, affecting applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-1819?
CVE-2015-1819 is a medium-severity denial of service vulnerability in Apple Iphone Os, published on 14 Aug 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.
Weakness: CWE-399
Which versions are affected by CVE-2015-1819?
2 open source packages ship an affected version, including nokogiri. It affects 12 products.
| Package | Affected | Fixed in |
|---|---|---|
nokogiri RubyGems | From 1.6.6.0 | 1.6.6.4 |
nokogiri RubyGems | From 1.6.6.0 | 1.6.6.4 |
Linux distribution packages (20)
libxml2 Red Hat:enterprise_linux:6::client | All versions | 0:2.7.6-20.el6 |
libxml2-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:2.7.6-20.el6 |
libxml2-devel Red Hat:enterprise_linux:6::client | All versions | 0:2.7.6-20.el6 |
libxml2-python Red Hat:enterprise_linux:6::client | All versions | 0:2.7.6-20.el6 |
libxml2-static Red Hat:enterprise_linux:6::client | All versions | 0:2.7.6-20.el6 |
libxml2 Red Hat:enterprise_linux:6::computenode | All versions | 0:2.7.6-20.el6 |
libxml2-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:2.7.6-20.el6 |
libxml2-devel Red Hat:enterprise_linux:6::computenode | All versions | 0:2.7.6-20.el6 |
libxml2-python Red Hat:enterprise_linux:6::computenode | All versions | 0:2.7.6-20.el6 |
libxml2-static Red Hat:enterprise_linux:6::computenode | All versions | 0:2.7.6-20.el6 |
libxml2 Red Hat:enterprise_linux:6::server | All versions | 0:2.7.6-20.el6 |
libxml2-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:2.7.6-20.el6 |
libxml2-devel Red Hat:enterprise_linux:6::server | All versions | 0:2.7.6-20.el6 |
libxml2-python Red Hat:enterprise_linux:6::server | All versions | 0:2.7.6-20.el6 |
libxml2-static Red Hat:enterprise_linux:6::server | All versions | 0:2.7.6-20.el6 |
libxml2 Red Hat:enterprise_linux:6::workstation | All versions | 0:2.7.6-20.el6 |
libxml2-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 0:2.7.6-20.el6 |
libxml2-devel Red Hat:enterprise_linux:6::workstation | All versions | 0:2.7.6-20.el6 |
libxml2-python Red Hat:enterprise_linux:6::workstation | All versions | 0:2.7.6-20.el6 |
libxml2-static Red Hat:enterprise_linux:6::workstation | All versions | 0:2.7.6-20.el6 |
Products include Apple Iphone Os, Apple Mac Os X, Apple Tvos, Apple Watchos, Canonical Ubuntu Linux, Debian Debian Linux and 6 more.
How do I fix CVE-2015-1819?
Upgrade nokogiri to 1.6.6.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2015-1819 being exploited?
There is no known exploitation of CVE-2015-1819 in the wild and no public exploit code.
Other vulnerabilities in Apple Iphone Os
Sources
Also known as DEBIAN-CVE-2015-1819, ECHO-9e8d-e519-2701, GHSA-q7wx-62r7-j2x7, MGASA-2015-0358, RHSA-2015:1419, UBUNTU-CVE-2015-1819.