Nokogiri vulnerable to libxml XML Entity Expansion

보통 5.0CVE-2015-1819 · GHSA-q7wx-62r7-j2x7 · Published 14/08/2015 · updated 17/06/2026

요약

CVE-2015-1819은(는) nokogiri에 영향을 주는 보통 (CVSS 5.0) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 6.3%, 전체 취약점의 93.6%보다 높음.
조치: 1.6.6.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
nokogiri RubyGems	`≥ 1.6.6.0, < 1.6.6.4`	`1.6.6.4`

Description

The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.

NVD description

The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.

References

nvd.nist.gov/vuln/detail/CVE-2015-1819 · ADVISORY
sparklemotion/nokogiri · WEB
git.gnome.org/browse/libxml2/commit · WEB
rubysec/ruby-advisory-db · WEB
security.gentoo.org/glsa/201507-08 · WEB
security.gentoo.org/glsa/201701-37 · WEB
support.apple.com/HT206166 · WEB
support.apple.com/HT206167 · WEB
support.apple.com/HT206168 · WEB
support.apple.com/HT206169 · WEB
lists.apple.com/archives/security-announce/2016/Mar/msg00000.html · WEB
lists.apple.com/archives/security-announce/2016/Mar/msg00001.html · WEB

nokogiri의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

nokogiri

RubyGems

≥ 1.6.6.0, < 1.6.6.4

1.6.6.4

Description

The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.

NVD description

The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.

nokogiri의 다른 취약점

모두 보기 →