CVE-2015-3451 XML external entity in n/a
Remote attackers can exploit XML external entity vulnerabilities in the XML::LibXML Perl library to read sensitive files or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-3451?
CVE-2015-3451 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 12 May 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.
Weakness: CWE-611
Which versions are affected by CVE-2015-3451?
It affects 5 products.
Linux distribution packages (4)
perl-XML-LibXML SUSE:Linux Enterprise Desktop 12 | All versions | 2.0019-5.3 |
perl-XML-LibXML SUSE:Linux Enterprise Server 12 | All versions | 2.0019-5.3 |
perl-XML-LibXML SUSE:Linux Enterprise Server for SAP Applications 12 | All versions | 2.0019-5.3 |
perl-XML-LibXML openSUSE:Tumbleweed | All versions | 2.0128-1.3 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Opensuse Opensuse, Xml-Libxml Project Xml-Libxml.
How do I fix CVE-2015-3451?
Upgrade to a fixed version.
Is CVE-2015-3451 being exploited?
There is no known exploitation of CVE-2015-3451 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2015-3451, DLA-214-1, DSA-3243-1, GHSA-mrvg-p24w-mp92, MGASA-2015-0199, SUSE-SU-2015:1439-1 and 3 more.