CVE catalog

CVE-2013-0339

libxml2: CVE-2013-0339

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
3.61% · Oct 25, 2026

libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibxml2sid2.15.4+dfsg-1fixed
Debianlibxml2forky2.15.4+dfsg-1fixed
Debianlibxml2trixie2.12.7+dfsg+really2.9.14-2.1+deb13u3fixed
Debianlibxml2trixie-security2.12.7+dfsg+really2.9.14-2.1+deb13u1fixed
Debianlibxml2bookworm2.9.14+dfsg-1.3~deb12u6fixed
Debianlibxml2bookworm-security2.9.14+dfsg-1.3~deb12u4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibxml2sourcesid2.8.0+dfsg1-7+nmu1not yet assignedNot reported[702260]
Debianlibxml2sourceforky2.8.0+dfsg1-7+nmu1not yet assignedNot reported[702260]
Debianlibxml2sourcetrixie2.8.0+dfsg1-7+nmu1not yet assignedNot reported[702260]
Debianlibxml2sourcebookworm2.8.0+dfsg1-7+nmu1not yet assignedNot reported[702260]

[Debian bug #702260]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libxml2]Unknown
    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

  • [libxml2-dev]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

  • [libxml2-doc]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · all · bookworm

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · all · bookworm-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

  • [libxml2-utils]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

  • [python3-libxml2]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.9.14+dfsg-1.3~deb12u6 · amd64 · bookworm

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u6 · arm64 · bookworm

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

    • 2.9.14+dfsg-1.3~deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · bookworm; dsa · libxml2 · debian · 12

[Debian 13 (Trixie)]

  • [libxml2]Unknown
    Details (4)

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

  • [libxml2-dev]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

  • [libxml2-doc]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · all · trixie

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · all · trixie

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

  • [libxml2-utils]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

  • [python3-libxml2]Unknown

    Source package: [libxml2]

    Details (4)

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

    • 2.12.7+dfsg+really2.9.14-2.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.8.0+dfsg1-7+nmu1

      dsa · libxml2 · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]