CVE-2014-5265

Name	CVE-2014-5265
Description	The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-56-1, DSA-2999-1, DSA-3001-1
Debian Bugs	757312

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wordpress (PTS)	buster	5.0.15+dfsg1-0+deb10u1	fixed
	buster (security)	5.0.18+dfsg1-0+deb10u1	fixed
	bullseye (security), bullseye	5.7.8+dfsg1-0+deb11u2	fixed
	bookworm, sid	6.1.1+dfsg1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
drupal6	source	squeeze	(unfixed)	end-of-life
drupal6	source	(unstable)	(unfixed)
drupal7	source	wheezy	7.14-2+deb7u6		DSA-2999-1
drupal7	source	(unstable)	7.31-1
wordpress	source	squeeze	3.6.1+dfsg-1~deb6u5		DLA-56-1
wordpress	source	wheezy	3.6.1+dfsg-1~deb7u4		DSA-3001-1
wordpress	source	(unstable)	3.9.2+dfsg-1			757312

https://core.trac.wordpress.org/changeset/29405/branches/3.9
https://www.drupal.org/SA-CORE-2014-004