lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Aug 30, 2017 | Apr 9, 2013 |
| Centos_linux | — | Upgrade rubyUpgrade ruby-staticUpgrade ruby-modeUpgrade ruby-riUpgrade ruby-develUpgrade ruby-libsUpgrade ruby-tcltkUpgrade ruby-rdocUpgrade ruby-irbUpgrade ruby-docs | Dec 1, 2016 | Apr 9, 2013 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Apr 9, 2013 |
| Oracle Solaris | — | Upgrade runtime/ruby-19 to version 1.9.3.551-0.175.2.13.0.4.0 on Solaris 11.2 | May 29, 2017 | Apr 9, 2013 |
| Oracle_linux | — | Upgrade ruby-docsUpgrade ruby-rdocUpgrade ruby-modeUpgrade ruby-libsUpgrade rubyUpgrade ruby-riUpgrade ruby-tcltkUpgrade ruby-irbUpgrade ruby-devel | Oct 16, 2024 | Apr 9, 2013 |
| Suse | — | Upgrade ruby-tkUpgrade ruby-debugsourceUpgrade ruby-doc-htmlUpgrade ruby19Upgrade ruby-commonUpgrade ruby19-develUpgrade ruby19-tkUpgrade ruby-tk-debuginfoUpgrade ruby-doc-riUpgrade ruby-develUpgrade ruby19-devel-extraUpgrade ruby19-doc-riUpgrade rubyUpgrade ruby-debuginfoUpgrade ruby-examplesUpgrade sle-sdk-releaseUpgrade ruby-test-suite | Dec 12, 2013 | Apr 9, 2013 |
| Ubuntu | — | Upgrade ruby1.8Upgrade libruby1.8Upgrade ruby1.9.1Upgrade libruby1.9.1 | Nov 8, 2024 | Apr 9, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub