Read the docs
TI-2014-02978 Aliases CVE-2014-3660GHSA-xrph-4qjj-gj25

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when…

Priority LOW 29Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.

Why it matters now

EPSS 0.03782 90th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 116

CPEVersionsRoleVendor
cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:*up to 2.9.1Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.0.0:*:*:*:*:*:*:*2.0.0Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.1.0:*:*:*:*:*:*:*2.1.0Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.1.1:*:*:*:*:*:*:*2.1.1Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.2.0:*:*:*:*:*:*:*2.2.0Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.2.0:beta:*:*:*:*:*:*2.2.0 betaVulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.2.1:*:*:*:*:*:*:*2.2.1Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.2.2:*:*:*:*:*:*:*2.2.2Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.2.3:*:*:*:*:*:*:*2.2.3Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.2.4:*:*:*:*:*:*:*2.2.4Vulnerablexmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:*:*:*:*:*:*:*:* Versions up to 2.9.1 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.2.0:beta:*:*:*:*:*:* Versions 2.2.0 beta Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·xmlsoft
Show 106 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:xmlsoft:libxml2:2.2.5:*:*:*:*:*:*:*2.2.5Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.2.6:*:*:*:*:*:*:*2.2.6Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.2.7:*:*:*:*:*:*:*2.2.7Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.2.8:*:*:*:*:*:*:*2.2.8Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.2.9:*:*:*:*:*:*:*2.2.9Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.2.10:*:*:*:*:*:*:*2.2.10Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.2.11:*:*:*:*:*:*:*2.2.11Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.0:*:*:*:*:*:*:*2.3.0Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.1:*:*:*:*:*:*:*2.3.1Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.2:*:*:*:*:*:*:*2.3.2Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.3:*:*:*:*:*:*:*2.3.3Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.4:*:*:*:*:*:*:*2.3.4Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.5:*:*:*:*:*:*:*2.3.5Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.6:*:*:*:*:*:*:*2.3.6Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.7:*:*:*:*:*:*:*2.3.7Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.8:*:*:*:*:*:*:*2.3.8Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.9:*:*:*:*:*:*:*2.3.9Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.10:*:*:*:*:*:*:*2.3.10Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.11:*:*:*:*:*:*:*2.3.11Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.12:*:*:*:*:*:*:*2.3.12Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.13:*:*:*:*:*:*:*2.3.13Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.3.14:*:*:*:*:*:*:*2.3.14Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.1:*:*:*:*:*:*:*2.4.1Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.2:*:*:*:*:*:*:*2.4.2Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.3:*:*:*:*:*:*:*2.4.3Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.4:*:*:*:*:*:*:*2.4.4Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.5:*:*:*:*:*:*:*2.4.5Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.6:*:*:*:*:*:*:*2.4.6Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.7:*:*:*:*:*:*:*2.4.7Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.8:*:*:*:*:*:*:*2.4.8Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.9:*:*:*:*:*:*:*2.4.9Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.10:*:*:*:*:*:*:*2.4.10Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.11:*:*:*:*:*:*:*2.4.11Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.12:*:*:*:*:*:*:*2.4.12Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.13:*:*:*:*:*:*:*2.4.13Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.14:*:*:*:*:*:*:*2.4.14Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.15:*:*:*:*:*:*:*2.4.15Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.16:*:*:*:*:*:*:*2.4.16Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.17:*:*:*:*:*:*:*2.4.17Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.18:*:*:*:*:*:*:*2.4.18Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.19:*:*:*:*:*:*:*2.4.19Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.20:*:*:*:*:*:*:*2.4.20Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.21:*:*:*:*:*:*:*2.4.21Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.22:*:*:*:*:*:*:*2.4.22Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.23:*:*:*:*:*:*:*2.4.23Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.24:*:*:*:*:*:*:*2.4.24Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.25:*:*:*:*:*:*:*2.4.25Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.26:*:*:*:*:*:*:*2.4.26Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.27:*:*:*:*:*:*:*2.4.27Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.28:*:*:*:*:*:*:*2.4.28Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.29:*:*:*:*:*:*:*2.4.29Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.4.30:*:*:*:*:*:*:*2.4.30Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.5.0:*:*:*:*:*:*:*2.5.0Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.5.4:*:*:*:*:*:*:*2.5.4Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.5.7:*:*:*:*:*:*:*2.5.7Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.5.8:*:*:*:*:*:*:*2.5.8Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.5.10:*:*:*:*:*:*:*2.5.10Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.5.11:*:*:*:*:*:*:*2.5.11Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.0:*:*:*:*:*:*:*2.6.0Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.1:*:*:*:*:*:*:*2.6.1Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.2:*:*:*:*:*:*:*2.6.2Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.3:*:*:*:*:*:*:*2.6.3Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.4:*:*:*:*:*:*:*2.6.4Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.5:*:*:*:*:*:*:*2.6.5Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.6:*:*:*:*:*:*:*2.6.6Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.7:*:*:*:*:*:*:*2.6.7Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.8:*:*:*:*:*:*:*2.6.8Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.9:*:*:*:*:*:*:*2.6.9Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.11:*:*:*:*:*:*:*2.6.11Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.12:*:*:*:*:*:*:*2.6.12Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.13:*:*:*:*:*:*:*2.6.13Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.14:*:*:*:*:*:*:*2.6.14Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.16:*:*:*:*:*:*:*2.6.16Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.17:*:*:*:*:*:*:*2.6.17Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.18:*:*:*:*:*:*:*2.6.18Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.20:*:*:*:*:*:*:*2.6.20Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.21:*:*:*:*:*:*:*2.6.21Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.22:*:*:*:*:*:*:*2.6.22Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.23:*:*:*:*:*:*:*2.6.23Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.24:*:*:*:*:*:*:*2.6.24Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.25:*:*:*:*:*:*:*2.6.25Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.26:*:*:*:*:*:*:*2.6.26Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.27:*:*:*:*:*:*:*2.6.27Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.28:*:*:*:*:*:*:*2.6.28Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.29:*:*:*:*:*:*:*2.6.29Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.30:*:*:*:*:*:*:*2.6.30Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.31:*:*:*:*:*:*:*2.6.31Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.6.32:*:*:*:*:*:*:*2.6.32Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.7.0:*:*:*:*:*:*:*2.7.0Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.7.1:*:*:*:*:*:*:*2.7.1Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.7.2:*:*:*:*:*:*:*2.7.2Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.7.3:*:*:*:*:*:*:*2.7.3Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.7.4:*:*:*:*:*:*:*2.7.4Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.7.5:*:*:*:*:*:*:*2.7.5Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.7.6:*:*:*:*:*:*:*2.7.6Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.7.7:*:*:*:*:*:*:*2.7.7Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.7.8:*:*:*:*:*:*:*2.7.8Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.8.0:*:*:*:*:*:*:*2.8.0Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.9.0:*:*:*:*:*:*:*2.9.0Vulnerablexmlsoft
cpe:2.3:a:xmlsoft:libxml2:2.9.0:rc1:*:*:*:*:*:*2.9.0 rc1Vulnerablexmlsoft
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*up to 10.10.4VulnerableApple
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*10.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*14.04VulnerableCanonical
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*7.0VulnerableDebian
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
  • cpe:2.3:a:xmlsoft:libxml2:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.2.7:*:*:*:*:*:*:* Versions 2.2.7 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.2.8:*:*:*:*:*:*:* Versions 2.2.8 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.2.9:*:*:*:*:*:*:* Versions 2.2.9 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.2.10:*:*:*:*:*:*:* Versions 2.2.10 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.2.11:*:*:*:*:*:*:* Versions 2.2.11 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.2:*:*:*:*:*:*:* Versions 2.3.2 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.3:*:*:*:*:*:*:* Versions 2.3.3 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.4:*:*:*:*:*:*:* Versions 2.3.4 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.5:*:*:*:*:*:*:* Versions 2.3.5 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.6:*:*:*:*:*:*:* Versions 2.3.6 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.7:*:*:*:*:*:*:* Versions 2.3.7 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.8:*:*:*:*:*:*:* Versions 2.3.8 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.9:*:*:*:*:*:*:* Versions 2.3.9 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.10:*:*:*:*:*:*:* Versions 2.3.10 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.11:*:*:*:*:*:*:* Versions 2.3.11 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.12:*:*:*:*:*:*:* Versions 2.3.12 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.13:*:*:*:*:*:*:* Versions 2.3.13 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.3.14:*:*:*:*:*:*:* Versions 2.3.14 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.2:*:*:*:*:*:*:* Versions 2.4.2 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.3:*:*:*:*:*:*:* Versions 2.4.3 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.4:*:*:*:*:*:*:* Versions 2.4.4 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.5:*:*:*:*:*:*:* Versions 2.4.5 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.6:*:*:*:*:*:*:* Versions 2.4.6 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.7:*:*:*:*:*:*:* Versions 2.4.7 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.8:*:*:*:*:*:*:* Versions 2.4.8 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.9:*:*:*:*:*:*:* Versions 2.4.9 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.10:*:*:*:*:*:*:* Versions 2.4.10 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.11:*:*:*:*:*:*:* Versions 2.4.11 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.12:*:*:*:*:*:*:* Versions 2.4.12 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.13:*:*:*:*:*:*:* Versions 2.4.13 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.14:*:*:*:*:*:*:* Versions 2.4.14 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.15:*:*:*:*:*:*:* Versions 2.4.15 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.16:*:*:*:*:*:*:* Versions 2.4.16 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.17:*:*:*:*:*:*:* Versions 2.4.17 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.18:*:*:*:*:*:*:* Versions 2.4.18 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.19:*:*:*:*:*:*:* Versions 2.4.19 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.20:*:*:*:*:*:*:* Versions 2.4.20 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.21:*:*:*:*:*:*:* Versions 2.4.21 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.22:*:*:*:*:*:*:* Versions 2.4.22 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.23:*:*:*:*:*:*:* Versions 2.4.23 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.24:*:*:*:*:*:*:* Versions 2.4.24 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.25:*:*:*:*:*:*:* Versions 2.4.25 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.26:*:*:*:*:*:*:* Versions 2.4.26 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.27:*:*:*:*:*:*:* Versions 2.4.27 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.28:*:*:*:*:*:*:* Versions 2.4.28 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.29:*:*:*:*:*:*:* Versions 2.4.29 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.4.30:*:*:*:*:*:*:* Versions 2.4.30 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.5.0:*:*:*:*:*:*:* Versions 2.5.0 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.5.4:*:*:*:*:*:*:* Versions 2.5.4 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.5.7:*:*:*:*:*:*:* Versions 2.5.7 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.5.8:*:*:*:*:*:*:* Versions 2.5.8 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.5.10:*:*:*:*:*:*:* Versions 2.5.10 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.5.11:*:*:*:*:*:*:* Versions 2.5.11 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.1:*:*:*:*:*:*:* Versions 2.6.1 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.2:*:*:*:*:*:*:* Versions 2.6.2 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.3:*:*:*:*:*:*:* Versions 2.6.3 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.4:*:*:*:*:*:*:* Versions 2.6.4 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.5:*:*:*:*:*:*:* Versions 2.6.5 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.6:*:*:*:*:*:*:* Versions 2.6.6 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.7:*:*:*:*:*:*:* Versions 2.6.7 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.8:*:*:*:*:*:*:* Versions 2.6.8 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.9:*:*:*:*:*:*:* Versions 2.6.9 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.11:*:*:*:*:*:*:* Versions 2.6.11 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.12:*:*:*:*:*:*:* Versions 2.6.12 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.13:*:*:*:*:*:*:* Versions 2.6.13 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.14:*:*:*:*:*:*:* Versions 2.6.14 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.16:*:*:*:*:*:*:* Versions 2.6.16 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.17:*:*:*:*:*:*:* Versions 2.6.17 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.18:*:*:*:*:*:*:* Versions 2.6.18 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.20:*:*:*:*:*:*:* Versions 2.6.20 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.21:*:*:*:*:*:*:* Versions 2.6.21 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.22:*:*:*:*:*:*:* Versions 2.6.22 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.23:*:*:*:*:*:*:* Versions 2.6.23 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.24:*:*:*:*:*:*:* Versions 2.6.24 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.25:*:*:*:*:*:*:* Versions 2.6.25 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.26:*:*:*:*:*:*:* Versions 2.6.26 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.27:*:*:*:*:*:*:* Versions 2.6.27 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.28:*:*:*:*:*:*:* Versions 2.6.28 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.29:*:*:*:*:*:*:* Versions 2.6.29 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.30:*:*:*:*:*:*:* Versions 2.6.30 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.31:*:*:*:*:*:*:* Versions 2.6.31 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.6.32:*:*:*:*:*:*:* Versions 2.6.32 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.7.3:*:*:*:*:*:*:* Versions 2.7.3 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.7.4:*:*:*:*:*:*:* Versions 2.7.4 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.7.5:*:*:*:*:*:*:* Versions 2.7.5 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.7.6:*:*:*:*:*:*:* Versions 2.7.6 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.7.7:*:*:*:*:*:*:* Versions 2.7.7 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.7.8:*:*:*:*:*:*:* Versions 2.7.8 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.9.0:*:*:*:*:*:*:* Versions 2.9.0 Vulnerable ·xmlsoft
  • cpe:2.3:a:xmlsoft:libxml2:2.9.0:rc1:*:*:*:*:*:* Versions 2.9.0 rc1 Vulnerable ·xmlsoft
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions up to 10.10.4 Vulnerable ·Apple
  • cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:* Versions 10.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2014:1885 Released 2014-11-20 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux (v. 5 server) libxml2-2.6.26-2.1.25.el5_11, libxml2-2.6.26-2.1.25.el5_11.i386, libxml2-2.6.26-2.1.25.el5_11.ia64 +9
    • Red Hat Enterprise Linux Desktop (v. 5 client) libxml2-2.6.26-2.1.25.el5_11, libxml2-2.6.26-2.1.25.el5_11.i386, libxml2-python-2.6.26-2.1.25.el5_11 +1
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) libxml2-2.6.26-2.1.25.el5_11, libxml2-devel-2.6.26-2.1.25.el5_11, libxml2-devel-2.6.26-2.1.25.el5_11.i386
  • RHSA-2014:1655 Released 2014-10-16 · Red Hat rating Moderate
    libxml2 security update
    • Red Hat Enterprise Linux Client (v. 7) libxml2-2.9.1-5.el7_0.1, libxml2-python-2.9.1-5.el7_0.1
    • Red Hat Enterprise Linux Client Optional (v. 7) libxml2-devel-2.9.1-5.el7_0.1, libxml2-static-2.9.1-5.el7_0.1
    • Red Hat Enterprise Linux ComputeNode (v. 7) libxml2-2.9.1-5.el7_0.1, libxml2-python-2.9.1-5.el7_0.1
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) libxml2-devel-2.9.1-5.el7_0.1, libxml2-static-2.9.1-5.el7_0.1
    • Red Hat Enterprise Linux Desktop (v. 6) libxml2-2.7.6-17.el6_6.1, libxml2-python-2.7.6-17.el6_6.1
    • Red Hat Enterprise Linux Desktop Optional (v. 6) libxml2-devel-2.7.6-17.el6_6.1, libxml2-static-2.7.6-17.el6_6.1
    • Red Hat Enterprise Linux HPC Node (v. 6) libxml2-2.7.6-17.el6_6.1, libxml2-python-2.7.6-17.el6_6.1
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) libxml2-devel-2.7.6-17.el6_6.1, libxml2-static-2.7.6-17.el6_6.1
    • Red Hat Enterprise Linux Server (v. 6) libxml2-2.7.6-17.el6_6.1, libxml2-2.7.6-17.el6_6.1.ppc, libxml2-devel-2.7.6-17.el6_6.1 +2
    • Red Hat Enterprise Linux Server (v. 7) libxml2-2.9.1-5.el7_0.1, libxml2-2.9.1-5.el7_0.1.ppc, libxml2-devel-2.9.1-5.el7_0.1 +2
    • Red Hat Enterprise Linux Server Optional (v. 6) libxml2-static-2.7.6-17.el6_6.1
    • Red Hat Enterprise Linux Server Optional (v. 7) libxml2-static-2.9.1-5.el7_0.1, libxml2-static-2.9.1-5.el7_0.1.ppc
    • Red Hat Enterprise Linux Workstation (v. 6) libxml2-2.7.6-17.el6_6.1, libxml2-devel-2.7.6-17.el6_6.1, libxml2-python-2.7.6-17.el6_6.1
    • Red Hat Enterprise Linux Workstation (v. 7) libxml2-2.9.1-5.el7_0.1, libxml2-devel-2.9.1-5.el7_0.1, libxml2-python-2.9.1-5.el7_0.1
    • Red Hat Enterprise Linux Workstation Optional (v. 6) libxml2-static-2.7.6-17.el6_6.1
    • Red Hat Enterprise Linux Workstation Optional (v. 7) libxml2-static-2.9.1-5.el7_0.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2014:1885
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2014:1655
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2014:1655
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2014:1655
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2014:1655
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2014:1885
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2014:1655
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2014:1655
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2014:1885
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2014:1655
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2014:1655
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:1655
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2014:1655
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2014:1655
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2014:1655
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:1655
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2014:1655
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2014:1655
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2014:1655

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-3660
  2. 2026-10-03 Alias added: GHSA-xrph-4qjj-gj25
  3. 2026-10-23 EPSS moved to the 50th–90th percentile
  4. 2026-11-06 EPSS moved to the 90th–95th percentile

References

Patch 1

Advisory 11

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences