CVE-2013-0340: Apple iPadOS

Medium severity, CVSS 6.8. EPSS: 19.4% chance of exploitation in the next 30 days.

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

Affected products

• Apple iPadOS: before 14.8 (fixed in 14.8)
• Apple iPhone OS: before 14.8 (fixed in 14.8)
• Apple macOS: before 11.6 (fixed in 11.6)
• Apple tvOS: before 15.0 (fixed in 15.0)
• Apple watchOS: before 8.0 (fixed in 8.0)
• Libexpat Project Libexpat: before 2.4.0 (fixed in 2.4.0)
• Python Python: from 3.6.0, before 3.6.15 (fixed in 3.6.15); from 3.7.0, before 3.7.12 (fixed in 3.7.12); from 3.8.0, before 3.8.12 (fixed in 3.8.12); from 3.9.0, before 3.9.7 (fixed in 3.9.7)

Published 2014-01-21. Last modified 2026-10-09.