The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Ruby | — | Upgrade macOS to the latest version | Apr 5, 2017 | Nov 3, 2014 |
| Centos_linux | — | Upgrade rubygem-rdocUpgrade ruby-rdocUpgrade rubyUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade ruby-irbUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygemsUpgrade ruby-staticUpgrade rubygem-jsonUpgrade ruby-libsUpgrade ruby-docsUpgrade ruby-riUpgrade rubygem-minitestUpgrade rubygems-develUpgrade ruby-tcltkUpgrade rubygem-psych | Dec 1, 2016 | Nov 3, 2014 |
| Gentoo Linux | — | Upgrade dev-lang/ruby. | Oct 30, 2017 | Nov 3, 2014 |
| Oracle Solaris | — | Upgrade runtime/ruby-19 to version 1.9.3.551-0.175.2.13.0.4.0 on Solaris 11.2 | May 29, 2017 | Nov 3, 2014 |
| Oracle_linux | — | Upgrade ruby193-rubygems-develUpgrade ruby-irbUpgrade ruby193-rubygem-rdocUpgrade ruby193-ruby-irbUpgrade ruby-rdocUpgrade ruby193-rubygem-jsonUpgrade ruby-tcltkUpgrade ruby193-rubygemsUpgrade ruby193-rubygem-bigdecimalUpgrade ruby193-rubygem-rakeUpgrade ruby193-rubygem-minitestUpgrade ruby193-rubyUpgrade ruby193-ruby-libsUpgrade ruby-develUpgrade ruby193-ruby-tcltkUpgrade ruby193-ruby-docUpgrade ruby-staticUpgrade ruby-libsUpgrade rubyUpgrade ruby193-rubygem-io-consoleUpgrade ruby-riUpgrade ruby-docsUpgrade ruby193-ruby-devel | Oct 16, 2024 | Nov 3, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 27, 2014 |
| Suse | — | Upgrade ruby2.1-develUpgrade ruby-test-suiteUpgrade rubyUpgrade ruby2.1-stdlibUpgrade ruby2.1Upgrade ruby-examplesUpgrade libruby2_1-2_1Upgrade ruby-doc-htmlUpgrade ruby-develUpgrade ruby-doc-riUpgrade ruby-tk | Dec 18, 2015 | Nov 3, 2014 |
| Ubuntu | — | Upgrade libruby1.9.1Upgrade libruby2.1Upgrade ruby2.0Upgrade libruby2.0Upgrade libruby1.8Upgrade ruby2.1Upgrade ruby1.8Upgrade ruby1.9.1 | Nov 8, 2024 | Nov 3, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub