Unscored severity · published May 23, 2014
CVE-2013-1864
The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to…
–
CVSS
2.8%
EPSS
No
On KEV
Description
The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references, aka a "billion laughs attack."
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EK
Ekiga · Ekiga
through 4.0.0 · source: NVD
PT
Portable Tool Library · Opalvoip
2.10.1; 2.10.2; 2.10.7; 2.10.9 · source: NVD
SL
Suse Linux Enterprise Desktop · Suse
11.0 · source: NVD
SL
Suse Linux Enterprise Software Development Kit · Suse
11.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-1864
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-1864
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099553.html
osvdb.org
http://osvdb.org/91439
seclists.org
http://seclists.org/oss-sec/2013/q1/674
secunia.com
http://secunia.com/advisories/52659
Exploit
http://sourceforge.net/p/opalvoip/code/28856
Patch
http://www.ekiga.org/news/2013-02-21/ekiga-4.0.1-stable-available
More from Ekiga
8.8
CVE-2011-1830
Ekiga versions before 3.3.0 attempted to load a module from /tmp/ekiga_test.so
–
CVE-2012-5621
lib/engine/components/opal/opal-call.cpp in ekiga before 4.0.0 allows remote attackers to cause a denial of service (crash) via an OPAL connection with a party name that contains…
–
CVE-2007-4924
The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to cause a denial of service (crash) via an…
–
CVE-2007-4897
pwlib, as used by Ekiga 2.0.5 and possibly other products, allows remote attackers to cause a denial of service (application crash) via a long argument to the PString::vsprintf…
–
CVE-2007-1007
Format string vulnerability in GnomeMeeting 1.0.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings…