Description
The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references, aka a "billion laughs attack."
References
- 52659 third-party-advisory
- SUSE-SU-2014:0237 vendor-advisory
- ptlib-xml-dos(82885) vdb-entry
- http://www.ekiga.org/news/2013-02-21/ekiga-4.0.1-stable-available
- FEDORA-2013-2998 vendor-advisory
- 91439 vdb-entry
- [oss-security] 20130315 Re: CVE request: billion laughs flaw in ptlib mailing-list
- http://sourceforge.net/p/opalvoip/code/28856
- 58520 vdb-entry