CVE-2018-1000889 - Logisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability in Circuit file loading functionality (loadXmlFrom in src/com/cburch/logisim/file/XmlReader.java) that can result in information leak, possible RCE depending on system configuration

Back Back to CVE browser

HIGH

Logisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability in Circuit file loading functionality (loadXmlFrom in src/com/cburch/logisim/file/XmlReader.java) that can result in information leak, possible RCE depending on system configuration

Published Dec 27, 2018

8.8

HIGH

CVSS 3.0

EPSS 1.47%

Description

Logisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability in Circuit file loading functionality (loadXmlFrom in src/com/cburch/logisim/file/XmlReader.java) that can result in information leak, possible RCE depending on system configuration. This attack appears to be exploitable via the victim opening a specially crafted circuit file. This vulnerability appears to have been fixed in 2.14.4.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (2)

https://github.com/reds-heig/logisim-evolution/pull/139
x_refsource_MISCPatchThird Party Advisory
https://www.kvakil.me/posts/logisim/
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://github.com/reds-heig/logisim-evolution/pull/139		x_refsource_MISCPatchThird Party Advisory
https://www.kvakil.me/posts/logisim/		x_refsource_MISCThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 27, 2018

Updated Sep 16, 2024

Reserved Dec 27, 2018

Link CVE-2018-1000889

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-1000889

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-1000889