It has been recently discovered that the SUPEE-3762 patch, released in August 2014 "accidently" fixed a Denial of Service exploit (see: https://www.byte.nl/blog/denial-of-service-flaw-in-magento)
Like many others we had ignored the patch because the original description did not contain this information and it was not labelled as security patch. It seemed to only fix a bug that was irrelevant if you were not using the SOAP API.
Now there is conflicting information about the versions that are affected.
The blog post linked above states
Only Magento 184.108.40.206 and 220.127.116.11 are affected
The public download page currently offers only a patch for EE 18.104.22.168 (and nothing in the Enterprise download section):
Two days ago, before the patch description has been updated, it was CE 1.6.x - 1.9.xnot true, I had confused it with SUPEE-6237.
This leaves me with the questions
Is this still the same patch file?Is this the right patch file for Magento CE ?
- Do I need to patch EE 1.14.1 shops?
(for now, I will go with the safe approach and add
libxml_disable_entity_loader(false); to all index.php files, but I consider this a temporary fix)