The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libxml2 | Aug 30, 2017 | Jan 21, 2015 |
| Apple Osx Apache | — | Apply OS X security update 2015-006Upgrade macOS to the latest version | Aug 28, 2015 | Jan 21, 2015 |
| Apple Osx Libxml2 | — | Upgrade macOS to the latest versionApply OS X security update 2015-006 | Mar 29, 2016 | Jan 21, 2015 |
| Centos_linux | — | Upgrade libxml2-develUpgrade libxml2Upgrade libxml2-staticUpgrade libxml2-python | Dec 1, 2016 | Jan 21, 2015 |
| Debian | — | Upgrade libxml2 | Jul 30, 2024 | Jan 21, 2015 |
| Freebsd | — | Upgrade linux-f10-libxml2Upgrade libxml2Upgrade linux-c6-libxml2 | Dec 10, 2025 | May 6, 2014 |
| Gentoo Linux | — | Upgrade dev-libs/libxml2. | Oct 30, 2017 | Jan 21, 2015 |
| Ibm Aix | — | Apply the fix or workaround for libxml2_advisory | Nov 30, 2017 | Jan 21, 2015 |
| Oracle Solaris | — | Upgrade runtime/python-27 to version 2.7.3-0.175.2.1.0.5.0 on Solaris 11.2Upgrade runtime/python-26 to version 2.6.8-0.175.2.1.0.5.0 on Solaris 11.2Upgrade library/python-2/libxml2-26 to version 2.9.1-0.175.2.1.0.4.0 on Solaris 11.2Upgrade library/libxml2 to version 2.9.1-0.175.2.1.0.4.0 on Solaris 11.2Upgrade library/python-2/libxml2-27 to version 2.9.1-0.175.2.1.0.4.0 on Solaris 11.2 | May 29, 2017 | Jan 21, 2015 |
| Oracle_linux | — | Upgrade libxml2-pythonUpgrade libxml2Upgrade libxml2-staticUpgrade libxml2-devel | Oct 16, 2024 | Jan 21, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 6, 2014 |
| Suse | — | Upgrade python3-libxml2-pythonUpgrade libxml2Upgrade python-libxml2Upgrade libxml2-develUpgrade libxml2-toolsUpgrade libxml2-2Upgrade libxml2-pythonUpgrade ruby2.5-rubygem-nokogiriUpgrade libxml2-x86Upgrade libxml2-32bitUpgrade sles12-docker-imageUpgrade libxml2-2-32bitUpgrade sles12sp1-docker-imageUpgrade libxml2-devel-32bitUpgrade libxml2-doc | Dec 18, 2015 | Jan 21, 2015 |
| Ubuntu | — | Upgrade libxml2 | Nov 8, 2024 | Jan 21, 2015 |
| Vmsa 2014 0012 | — | Upgrade VMware ESXi 5.0 to build number 2210222Upgrade VMware ESXi 5.5 to build number 2068190Upgrade VMware ESXi 5.1 to build number 2323236 | Oct 28, 2015 | Jan 21, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub