CVE-2013-0339
libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity…
- 6.8MediumCVSS base score
- 3.6%Exploitation in 30 daysEPSS · top 10% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.
Timeline
ID reserved
By redhat
- 14 months later
· 14 months later
Published
- 11 years later
· 11 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | Medium6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
- EPSS (exploitation in 30 days)
- 3.6% · top 10% of all CVEs (10 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.
Affected products
n/a
- affected n/a
References
15
- 52662 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- SUSE-SU-2013:1627 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- [oss-security] 20130221 CVE Guidance for Libraries and Resource-Consumption DoS (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [oss-security] 20131029 Re: CVE Request: libxml2 external parsed entities issue (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [oss-security] 20131029 Re: CVE Request: libxml2 external parsed entities issue (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [oss-security] 20131028 Re: CVE Request: libxml2 external parsed entities issue (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- USN-1904-2 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
- USN-1904-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
- DSA-2652 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- https://bugzilla.redhat.com/show_bug.cgi?id=915149 (opens in a new tab)x_refsource_MISCx_transferred
- 54172 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- 55568 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
- https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f (opens in a new tab)x_refsource_MISCx_transferred
- [oss-security] 20130412 Re-evaluating expat/libxml2 CVE assignments (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2013-0351 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2013-0339)Record last updated .