CVE-2013-6460

MEDIUM EPSS 79.3%

Published Nov 5, 20196y ago · Modified Jun 17, 20262w ago

6.5 CVSS 3.1

Medium

Published Nov 5, 2019 6y ago

Last Modified Jun 17, 2026 2w ago

Description

Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents

Base Score

6.5

Exploitability

2.8

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality None

Integrity None

Availability High

EPSS Exploit Probability

79.3% percentile

Exploit & Patch Status

Public Exploit Known

Patch Available

CWE-776

Vendor	Product	Version	Range
nokogiri	nokogiri	*	≥1.5.0 – <1.5.11
nokogiri	nokogiri	*	≥1.6.0 – <1.6.1
debian	debian_linux	8.0	any
debian	debian_linux	9.0	any
debian	debian_linux	10.0	any
redhat	cloudforms_management_engine	5.0	any
redhat	openstack	3.0	any
redhat	openstack	4.0	any
redhat	satellite	6.0	any
redhat	subscription_asset_manager	*	any
redhat	enterprise_mrg	2.0	any

openwall.com http://www.openwall.com/lists/oss-security/2013/12/27/2

Mailing ListThird Party Advisory
securityfocus.com http://www.securityfocus.com/bid/64513

Third Party AdvisoryVDB Entry
access.redhat.com https://access.redhat.com/security/cve/cve-2013-6460

Third Party Advisory
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460

ExploitIssue TrackingPatchThird Party Advisory
bugzilla.suse.com https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460

Issue TrackingThird Party Advisory
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/90058

Third Party AdvisoryVDB Entry
security-tracker.debian.org https://security-tracker.debian.org/tracker/CVE-2013-6460

Third Party Advisory

bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460

ExploitIssue TrackingPatchThird Party Advisory