CVE-2013-4113

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-41145.0The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which a CVE-2013-41157.5Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows remote attackers to CVE-2013-41163.3lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary fil CVE-2013-41174.3Cross-site scripting (XSS) vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows rem CVE-2013-41187.5FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspeci CVE-2013-41197.5FreeRDP before 1.1.0-beta+2013071101 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) b CVE-2013-41207.5Katello has a Denial of Service vulnerability in API OAuth authentication CVE-2013-41224.3Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as impleme CVE-2013-41235.0client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafte CVE-2013-41245.0Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4 CVE-2013-41255.4The fib6_add_rt2node function in net/ipv6/ip6_fib.c in the IPv6 stack in the Linux kernel through 3.10.1 does not properly handle Router Adv CVE-2013-41274.7Use-after-free vulnerability in the vhost_net_set_backend function in drivers/vhost/net.c in the Linux kernel through 3.10.3 allows local us