CVE-2011-1755: apple mac_os_x XML Entity Expansion
CVSS: 7.5v3.1HighModified
AliasesRHSA-2011:0881RHSA-2011:0882DEBIAN-CVE-2011-1755
Published 21-06-2011Last modified 06-08-2024
Vulnerability summary
CVE-2011-1755 is a high (CVSS 7.5) XML Entity Expansion vulnerability in apple mac_os_x. EPSS estimates a 3.66% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
3.66%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 21-06-2011PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 2 agree
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
3.66%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.66% on 21-09-2026
21-09-202621-10-2026
EPSS score3.66%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apple2 products
- mac_os_x< 10.6.8 | ≥ 10.7.0, < 10.7.2
- mac_os_x_server< 10.6.8 | ≥ 10.7.0, < 10.7.2
Redhat2 products
- jabberd< 0:2.2.8-12.el5sat
- jabberd-debuginfo< 0:2.2.8-12.el5sat
Debian1 product
- jabberd2< 2.2.8-2.1
Fedoraproject1 product
- fedoraEOL13 | 14 | 15
Jabberd21 product
- jabberd2< 2.2.14
5 vendors · 7 products
References
25 links- lists.apple.com/archives/Security-announce/2011//Oct/msg00003.htmlVendor AdvisoryX Refsource APPLEMailing List
- lists.fedoraproject.org/pipermail/package-announce/2011-June/061341.htmlVendor AdvisoryX Refsource FEDORAMailing List
- lists.fedoraproject.org/pipermail/package-announce/2011-June/061458.htmlVendor AdvisoryX Refsource FEDORAMailing List
Show all 25 references
- lists.fedoraproject.org/pipermail/package-announce/2011-June/061482.htmlVendor AdvisoryX Refsource FEDORAMailing List
- www.mail-archive.com/jabberd2%40lists.xiaoka.com/msg01655.htmlMailing ListX Refsource MLISTRelease Notes
