CVE-2015-3451: canonical ubuntu_linux
Vulnerability summary
CVE-2015-3451 is a medium (CVSS 5.0) vulnerability in canonical ubuntu_linux. EPSS estimates a 4.02% chance of exploitation in the next 30 days, higher than 90.5% of scored vulnerabilities.
Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 12-05-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The _clone function in XML::LibXML before 2.0119 does not properly set the expand_entities option, which allows remote attackers to conduct XML external entity (XXE) attacks via crafted XML data to the (1) new or (2) load_xml function.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
4.02%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
Increase +0.03 pp
From 3.98% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Suse3 products
- perl-XML-LibXML&distro=SUSE Linux Enterprise Desktop 12< 2.0019-5.3
- perl-XML-LibXML&distro=SUSE Linux Enterprise Server 12< 2.0019-5.3
- perl-XML-LibXML&distro=SUSE Linux Enterprise Server for SAP Applications 12< 2.0019-5.3
Debian2 products
- libxml-libxml-perl< 2.0116+dfsg-2 | < 1.70.ds-1+deb6u1 | < 2.0001+dfsg-1+deb7u1 | < 2.0116+dfsg-1+deb8u1
- debian_linuxEOL7.0 | 8.0
Opensuse2 products
- opensuseEOL13.1 | 13.2
- perl-XML-LibXML&distro=openSUSE Tumbleweed< 2.0128-1.3
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 14.10 | 15.04
Fedoraproject1 product
- fedoraEOL20 | 21
Mageia1 product
- perl-XML-LibXML< 2.10.0-2.1.mga4
Ubuntu1 product
- libxml-libxml-perl< 2.0108+dfsg-1ubuntu0.1
Xml-libxml_project1 product
- xml-libxml≤ 2.0118
8 vendors · 12 products
References
22 links- cpansearch.perl.org/src/SHLOMIF/XML-LibXML-2.0119/ChangesX Refsource CONFIRMRelease NotesThird Party Advisory
- bitbucket.org/shlomif/perl-xml-libxml/commits/5962fd067580767777e94640b129ae8930a68a30/raw/X Refsource CONFIRMVendor Advisory
- lists.fedoraproject.org/pipermail/package-announce/2015-May/157448.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2015-May/157740.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- www.openwall.com/lists/oss-security/2015/04/25/2Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
- lists.opensuse.org/opensuse-updates/2015-09/msg00006.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2015:231Vendor AdvisoryX Refsource MANDRIVABroken Link
Show all 22 references
- bugzilla.suse.com/929237REPORT