VULNERABILITY INTELLIGENCE

CVE-2015-2942

CVSS score7.1 HIGH
EPSS probability2.81%
CISA KEVNot currently listed
Published2015-04-13
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:N/I:N/A:C

Description

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937.

Primary references