CVE-2011-3287

Currently unrated

Key Information:

Vendor
Cisco
Status
Jabber Extensible Communications Platform
Vendor
CVE Published:
6 October 2011

Summary

Cisco Jabber Extensible Communications Platform (aka Jabber XCP) 2.x through 5.4.x before 5.4.0.27581 and 5.8.x before 5.8.1.27561 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and process crash) via a crafted XML document containing a large number of nested entity references, aka Bug ID CSCtq78106, a similar issue to CVE-2003-1564.

References

http://www.cisco.com/en/US/products/products_security_adv...
vendor-advisoryx_refsource_CISCO

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.