CVE-2013-6461

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-776

Affected software

Vendor	Product	Versions
Ruby	Nokogiri gem	1.5.x; 1.6.x

References

http://www.openwall.com/lists/oss-security/2013/12/27/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/64513Third Party Advisory, VDB Entry
https://access.redhat.com/security/cve/cve-2013-6461Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6461Exploit, Issue Tracking, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/90059Third Party Advisory, VDB Entry
https://security-tracker.debian.org/tracker/CVE-2013-6461Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/12/27/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/64513Third Party Advisory, VDB Entry
https://access.redhat.com/security/cve/cve-2013-6461Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6461Exploit, Issue Tracking, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/90059Third Party Advisory, VDB Entry
https://security-tracker.debian.org/tracker/CVE-2013-6461Third Party Advisory

Timeline

Published: Nov 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-64629.3Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attacker CVE-2013-64655.4Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web scr CVE-2013-64665.0Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 CVE-2013-64675.0Libreswan 3.7 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 p CVE-2013-64686.5JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitra CVE-2013-64696.5JBoss Overlord Run Time Governance (RTGov) 1.0 for JBossAS allows remote authenticated users to execute arbitrary Java code via an MVFLEX Ex CVE-2013-64705.0The default configuration in the standalone controller quickstack manifest in openstack-foreman-installer, as used in Red Hat Enterprise Lin CVE-2013-64725.0MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain information about deleted page via CVE-2013-64736.8Multiple heap-based buffer overflows in the urftopdf filter in cups-filters 1.0.25 before 1.0.47 allow remote attackers to execute arbitrary CVE-2013-64746.8Heap-based buffer overflow in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows remote attackers to execute arbitrary code CVE-2013-64756.8Multiple integer overflows in (1) OPVPOutputDev.cxx and (2) oprs/OPVPSplash.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.CVE-2013-64764.4The OPVPWrapper::loadDriver function in oprs/OPVPWrapper.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows local use