VULNERABILITY INTELLIGENCE

CVE-2015-5312

CVSS score7.1 HIGH
EPSS probability4.50%
CISA KEVNot currently listed
Published2015-12-15
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:N/I:N/A:C

Description

The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660.

Primary references