p PatchFirst

CVE-2014-8080

CVE-2014-8080

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack.

EPSS 5.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • ruby1.9.1 Ubuntu:14.04:LTS

    Versions
    • 1.9.3.194-8.1ubuntu2
    • 1.9.3.448-1ubuntu1
    • 1.9.3.448-1ubuntu2
    • 1.9.3.484-1ubuntu1
    • 1.9.3.484-1ubuntu2
    • 1.9.3.484-2ubuntu1
    Affected ranges
    • ECOSYSTEM: < 1.9.3.484-2ubuntu1.1

    Update to 1.9.3.484-2ubuntu1.1

  • ruby2.0 Ubuntu:14.04:LTS

    Versions
    • 2.0.0.299-2
    • 2.0.0.343-1
    • 2.0.0.343-1ubuntu1
    • 2.0.0.353-1
    • 2.0.0.353-1ubuntu1
    • 2.0.0.484-1ubuntu1
    • 2.0.0.484-1ubuntu2
    Affected ranges
    • ECOSYSTEM: < 2.0.0.484-1ubuntu2.1

    Update to 2.0.0.484-1ubuntu2.1

Original sources

Check your server →