UpHeron
All vulnerabilities

Servers and applications

CVE-2013-0338

libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.

Severity
Medium 4.3
Published
25 Apr 2013
Last changed
16 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
2.9% in the next 30 daysHigher than 86% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Memory buffer errors (CWE-119)
Attack
Over the network · No login needed
Attacker can
Slow it down
CVSS vector
AV:N/AC:M/Au:N/C:N/I:N/A:P
Sources
NVD

Affected software

SoftwareAffected versions
libxml2Servers and applications · cpe:a:xmlsoft:libxml2
  • Version 2.9.0-rc1
  • Version 2.7.8
  • Version 2.7.7
  • Version 2.7.6
All 126 release lines
  • Every version up to 2.9.0
  • Version 1.7.0
  • Version 1.7.1
  • Version 1.7.2
  • Version 1.7.3
  • Version 1.7.4
  • Version 1.8.0
  • Version 1.8.1
  • Version 1.8.2
  • Version 1.8.3
  • Version 1.8.4
  • Version 1.8.5
  • Version 1.8.6
  • Version 1.8.7
  • Version 1.8.9
  • Version 1.8.10
  • Version 1.8.13
  • Version 1.8.14
  • Version 1.8.16
  • Version 2.0.0
  • Version 2.1.0
  • Version 2.1.1
  • Version 2.2.0-beta
  • Version 2.2.0
  • Version 2.2.1
  • Version 2.2.2
  • Version 2.2.3
  • Version 2.2.4
  • Version 2.2.5
  • Version 2.2.6
  • Version 2.2.7
  • Version 2.2.8
  • Version 2.2.9
  • Version 2.2.10
  • Version 2.2.11
  • Version 2.3.0
  • Version 2.3.1
  • Version 2.3.2
  • Version 2.3.3
  • Version 2.3.4
  • Version 2.3.5
  • Version 2.3.6
  • Version 2.3.7
  • Version 2.3.8
  • Version 2.3.9
  • Version 2.3.10
  • Version 2.3.11
  • Version 2.3.12
  • Version 2.3.13
  • Version 2.3.14
  • Version 2.4.1
  • Version 2.4.2
  • Version 2.4.3
  • Version 2.4.4
  • Version 2.4.5
  • Version 2.4.6
  • Version 2.4.7
  • Version 2.4.8
  • Version 2.4.9
  • Version 2.4.10
  • Version 2.4.11
  • Version 2.4.12
  • Version 2.4.13
  • Version 2.4.14
  • Version 2.4.15
  • Version 2.4.16
  • Version 2.4.17
  • Version 2.4.18
  • Version 2.4.19
  • Version 2.4.20
  • Version 2.4.21
  • Version 2.4.22
  • Version 2.4.23
  • Version 2.4.24
  • Version 2.4.25
  • Version 2.4.26
  • Version 2.4.27
  • Version 2.4.28
  • Version 2.4.29
  • Version 2.4.30
  • Version 2.5.0
  • Version 2.5.4
  • Version 2.5.7
  • Version 2.5.8
  • Version 2.5.10
  • Version 2.5.11
  • Version 2.6.0
  • Version 2.6.1
  • Version 2.6.2
  • Version 2.6.3
  • Version 2.6.4
  • Version 2.6.5
  • Version 2.6.6
  • Version 2.6.7
  • Version 2.6.8
  • Version 2.6.9
  • Version 2.6.11
  • Version 2.6.12
  • Version 2.6.13
  • Version 2.6.14
  • Version 2.6.16
  • Version 2.6.17
  • Version 2.6.18
  • Version 2.6.20
  • Version 2.6.21
  • Version 2.6.22
  • Version 2.6.23
  • Version 2.6.24
  • Version 2.6.25
  • Version 2.6.26
  • Version 2.6.27
  • Version 2.6.28
  • Version 2.6.29
  • Version 2.6.30
  • Version 2.6.31
  • Version 2.6.32
  • Version 2.7.0
  • Version 2.7.1
  • Version 2.7.2
  • Version 2.7.3
  • Version 2.7.4
  • Version 2.7.5
  • Version 2.7.6
  • Version 2.7.7
  • Version 2.7.8
  • Version 2.9.0-rc1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2013-0338
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2013-0338