CVE-2014-3660 in Mac OS X
Summary
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Reservation
05/14/2014
Disclosure
11/03/2014
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE: