CVE-2013-0340: apple ipados

Modified

AliasesRHBA-2022:8290DEBIAN-CVE-2013-0340

Published 21-01-2014Last modified 14-10-2026

Vulnerability summary

CVE-2013-0340 is a medium (CVSS 6.8) vulnerability in apple ipados. EPSS estimates a 19.43% chance of exploitation in the next 30 days, higher than 97.3% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 6.8, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

19.43%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 10 · Related 4

OPENSUSE-SU-2024:10748-1 OPENSUSE-SU-2024:11285-1 RHSA-2025:21776 RHSA-2025:22035 RHSA-2025:22607 RHSA-2025:22785+4 more

Timeline

21-01-2014
PublishedVulnerability first disclosed.
14-10-2026
Last modifiedVulnerability information updated.

Description

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

19.43%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 19.43% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Apple5 products

ipados< 14.8
iphone_os< 14.8
macos< 11.6
tvos< 15.0
watchos< 8.0

Redhat4 products

expat< 0:2.4.9-1.el9_1
expat-debuginfo< 0:2.4.9-1.el9_1
expat-debugsource< 0:2.4.9-1.el9_1
expat-devel< 0:2.4.9-1.el9_1

Debian2 products

expat< 2.4.1-2
libxmltokAll versions (No fix recorded)

Libexpat_project1 product

libexpat< 2.4.0

Python1 product

python≥ 3.6.0, < 3.6.15 | ≥ 3.7.0, < 3.7.12 | ≥ 3.8.0, < 3.8.12 | ≥ 3.9.0, < 3.9.7

5 vendors · 13 products

References

35 links

openwall.com/lists/oss-security/2013/02/22/3Mailing ListX Refsource MLISTExploitThird Party Advisory
www.openwall.com/lists/oss-security/2013/04/12/6Mailing ListX Refsource MLISTThird Party Advisory
www.osvdb.org/90634VDB EntryX Refsource OSVDBBroken Link
securitytracker.com/id?1028213VDB EntryX Refsource SECTRACKThird Party Advisory
security.gentoo.org/glsa/201701-21Vendor AdvisoryX Refsource GENTOOThird Party Advisory
www.securityfocus.com/bid/58233VDB EntryX Refsource BIDBroken LinkThird Party Advisory
support.apple.com/kb/HT212805X Refsource CONFIRMThird Party Advisory
support.apple.com/kb/HT212804X Refsource CONFIRMThird Party Advisory
support.apple.com/kb/HT212807X Refsource CONFIRMThird Party Advisory
support.apple.com/kb/HT212819X Refsource CONFIRMThird Party Advisory

Show all 35 references

support.apple.com/kb/HT212814X Refsource CONFIRMThird Party Advisory
support.apple.com/kb/HT212815X Refsource CONFIRMThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/33Mailing ListX Refsource FULLDISCThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/34Mailing ListX Refsource FULLDISCThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/40Mailing ListX Refsource FULLDISCThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/35Mailing ListX Refsource FULLDISCThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/38Mailing ListX Refsource FULLDISCThird Party Advisory
seclists.org/fulldisclosure/2021/Sep/39Mailing ListX Refsource FULLDISCThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
www.openwall.com/lists/oss-security/2021/10/07/4Mailing ListX Refsource MLISTThird Party Advisory
seclists.org/fulldisclosure/2021/Oct/62Mailing ListX Refsource FULLDISCThird Party Advisory
seclists.org/fulldisclosure/2021/Oct/63Mailing ListX Refsource FULLDISCThird Party Advisory
seclists.org/fulldisclosure/2021/Oct/61Mailing ListX Refsource FULLDISCThird Party Advisory
github.com/libexpat/libexpat/blob/R_2_4_1/expat/Changes
access.redhat.com/errata/RHBA-2022:8290Advisory
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/indexARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2067201REPORT
security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_8290.jsonAdvisory
access.redhat.com/security/cve/CVE-2013-0340REPORT
bugzilla.redhat.com/show_bug.cgi?id=1000109REPORT
www.cve.org/CVERecord?id=CVE-2013-0340Advisory
nvd.nist.gov/vuln/detail/CVE-2013-0340AdvisoryOval
security-tracker.debian.org/tracker/CVE-2013-0340Advisory
cert-portal.siemens.com/productcert/html/ssa-398330.html