{"id":"CVE-2013-0340","state":"PUBLISHED","title":"expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to ","description":"expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.","publishedAt":"2014-01-21T18:00:00.000Z","updatedAt":"2026-10-14T06:25:17.335Z","severity":null,"assigner":"redhat","products":["libexpat"],"affected":[{"packageName":"libexpat","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.4.0","versionType":"semver"}],"collectionURL":"https://github.com/libexpat/libexpat/"}],"references":["http://openwall.com/lists/oss-security/2013/02/22/3","http://www.openwall.com/lists/oss-security/2013/04/12/6","http://www.osvdb.org/90634","http://securitytracker.com/id?1028213","https://security.gentoo.org/glsa/201701-21","http://www.securityfocus.com/bid/58233","https://support.apple.com/kb/HT212805","https://support.apple.com/kb/HT212804","https://support.apple.com/kb/HT212807","https://support.apple.com/kb/HT212819","https://support.apple.com/kb/HT212814","https://support.apple.com/kb/HT212815","http://seclists.org/fulldisclosure/2021/Sep/33","http://seclists.org/fulldisclosure/2021/Sep/34","http://seclists.org/fulldisclosure/2021/Sep/40","http://seclists.org/fulldisclosure/2021/Sep/35","http://seclists.org/fulldisclosure/2021/Sep/38","http://seclists.org/fulldisclosure/2021/Sep/39","https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/10/07/4","http://seclists.org/fulldisclosure/2021/Oct/62","http://seclists.org/fulldisclosure/2021/Oct/63","http://seclists.org/fulldisclosure/2021/Oct/61","https://github.com/libexpat/libexpat/blob/R_2_4_1/expat/Changes","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"weaknesses":[],"ingestedAt":"2026-10-29T19:40:33.795Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2013/0xxx/CVE-2013-0340.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2013-0340","state":"PUBLISHED","datePublished":"2014-01-21T18:00:00.000Z","dateUpdated":"2026-10-14T06:25:17.335Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2012-12-06T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE."}],"affected":[{"packageName":"libexpat","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.4.0","versionType":"semver"}],"collectionURL":"https://github.com/libexpat/libexpat/"}],"references":[{"url":"http://openwall.com/lists/oss-security/2013/02/22/3","name":"[oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2013/04/12/6","name":"[oss-security] 20130413 Re-evaluating expat/libxml2 CVE assignments","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.osvdb.org/90634","name":"90634","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://securitytracker.com/id?1028213","name":"1028213","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://security.gentoo.org/glsa/201701-21","name":"GLSA-201701-21","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://www.securityfocus.com/bid/58233","name":"58233","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://support.apple.com/kb/HT212805","tags":["x_refsource_CONFIRM"]},{"url":"https://support.apple.com/kb/HT212804","tags":["x_refsource_CONFIRM"]},{"url":"https://support.apple.com/kb/HT212807","tags":["x_refsource_CONFIRM"]},{"url":"https://support.apple.com/kb/HT212819","tags":["x_refsource_CONFIRM"]},{"url":"https://support.apple.com/kb/HT212814","tags":["x_refsource_CONFIRM"]},{"url":"https://support.apple.com/kb/HT212815","tags":["x_refsource_CONFIRM"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/33","name":"20210921 APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/34","name":"20210921 APPLE-SA-2021-09-20-2 watchOS 8","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/40","name":"20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/35","name":"20210921 APPLE-SA-2021-09-20-3 tvOS 15","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/38","name":"20210921 APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/39","name":"20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d%40%3Cannounce.apache.org%3E","name":"[announce] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E","name":"[openoffice-users] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/07/4","name":"[oss-security] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://seclists.org/fulldisclosure/2021/Oct/62","name":"20211027 APPLE-SA-2021-10-26-10 Additional information for APPLE-SA-2021-09-20-2 watchOS 8","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://seclists.org/fulldisclosure/2021/Oct/63","name":"20211027 APPLE-SA-2021-10-26-11 Additional information for APPLE-SA-2021-09-20-3 tvOS 15","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"http://seclists.org/fulldisclosure/2021/Oct/61","name":"20211027 APPLE-SA-2021-10-26-9 Additional information for APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"https://github.com/libexpat/libexpat/blob/R_2_4_1/expat/Changes","name":"Expat 2.4.0 and 2.4.1 Changelog"}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2025-11-25T16:27:56.273Z"},"datePublic":"2013-02-21T00:00:00.000Z"},"adp":[{"title":"CVE Program Container","references":[{"url":"http://openwall.com/lists/oss-security/2013/02/22/3","name":"[oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2013/04/12/6","name":"[oss-security] 20130413 Re-evaluating expat/libxml2 CVE assignments","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.osvdb.org/90634","name":"90634","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://securitytracker.com/id?1028213","name":"1028213","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201701-21","name":"GLSA-201701-21","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"http://www.securityfocus.com/bid/58233","name":"58233","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://support.apple.com/kb/HT212805","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://support.apple.com/kb/HT212804","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://support.apple.com/kb/HT212807","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://support.apple.com/kb/HT212819","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://support.apple.com/kb/HT212814","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://support.apple.com/kb/HT212815","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/33","name":"20210921 APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/34","name":"20210921 APPLE-SA-2021-09-20-2 watchOS 8","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/40","name":"20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/35","name":"20210921 APPLE-SA-2021-09-20-3 tvOS 15","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/38","name":"20210921 APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/39","name":"20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d%40%3Cannounce.apache.org%3E","name":"[announce] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E","name":"[openoffice-users] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/07/4","name":"[oss-security] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2021/Oct/62","name":"20211027 APPLE-SA-2021-10-26-10 Additional information for APPLE-SA-2021-09-20-2 watchOS 8","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2021/Oct/63","name":"20211027 APPLE-SA-2021-10-26-11 Additional information for APPLE-SA-2021-09-20-3 tvOS 15","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2021/Oct/61","name":"20211027 APPLE-SA-2021-10-26-9 Additional information for APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-06T14:25:10.013Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-09T19:10:44.290422Z","id":"CVE-2013-0340","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-09T19:10:54.037Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-14T06:25:17.335Z"},"x_adpType":"supplier"}]}}}