libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the billion laughs attack.
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libxml2 | Xmlsoft | * | 2.5.0 (excluding) |
| Red Hat Enterprise Linux 2.1 | RedHat | libxml2-0:2.4.19-11.ent | * |
| Libxml2 | Ubuntu | upstream | * |