It has been recently discovered that the SUPEE-3762 patch, released in August 2014 "accidently" fixed a Denial of Service exploit (see: https://www.byte.nl/blog/denial-of-service-flaw-in-magento)

Like many others we had ignored the patch because the original description did not contain this information and it was not labelled as security patch. It seemed to only fix a bug that was irrelevant if you were not using the SOAP API.

Now there is conflicting information about the versions that are affected.

  • The blog post linked above states

    Only Magento and are affected

  • The public download page currently offers only a patch for EE (and nothing in the Enterprise download section):


  • Two days ago, before the patch description has been updated, it was CE 1.6.x - 1.9.x not true, I had confused it with SUPEE-6237.

This leaves me with the questions

  1. Is this still the same patch file? Is this the right patch file for Magento CE ?
  2. Do I need to patch EE 1.14.1 shops?

(for now, I will go with the safe approach and add libxml_disable_entity_loader(false); to all index.php files, but I consider this a temporary fix)

3 Answers 3


The patch is no longer available because a more complete fix was included in SUPEE-6788. If you applied it, you should remove and install 6788.


If we see the section for the patch SUPEE-3762 there is a link given with it

"Note: please find details on this patch here."

When we go to that link it clearly mentiones

Note: Some of the patches discussed in this section have EE_1.14.0.1 in the name. These patches were all tested against CE 1.9.x as well.

enter image description here

I think we should rely on the official page information about this page.Even though Patch name may contain EE but Magento EE patches can be downloaded by enterprise edition customers only from my account section.

Please comment if I am wrong.

  • Thanks, this makes sense. The patch file does not seem to address enterprise specific files. Commented Sep 3, 2015 at 9:18
  • @fschmengler If my answer provides correct information related to your question, could you please accept it.
    – Mukesh
    Commented Sep 3, 2015 at 9:25
  • I was waiting for more/official answers, but heck, why not, I figured it out. :) Commented Sep 3, 2015 at 9:28

After patching an actual EE instance, I could see that the following files were affected:

patching file lib/Zend/Soap/Server.php
patching file lib/Zend/Xml/Exception.php
patching file lib/Zend/Xml/Security.php

where lib/Zend/Xml is a new directory. This is not specific to Magento Enterprise and I could apply the same patch on CE

However, Magento CE as well as EE already contain these changes. If you try to apply the patch on these versions, the output is:

Checking if patch can be applied/reverted successfully...
ERROR: Patch can't be applied/reverted successfully.

checking file lib/Zend/Soap/Server.php
Reversed (or previously applied) patch detected!  Assume -R? [n]
Apply anyway? [n]
Skipping patch.
2 out of 2 hunks ignored
The next patch would create the file lib/Zend/Xml/Exception.php,
which already exists!  Assume -R? [n]
Apply anyway? [n]
Skipping patch.
1 out of 1 hunk ignored
The next patch would create the file lib/Zend/Xml/Security.php,
which already exists!  Assume -R? [n]
Apply anyway? [n]
Skipping patch.
1 out of 1 hunk ignored

(that's fine, no action is needed)


PATCH_SUPEE-3762_EE_1.14.0.1_v1-2015-02-12-04-25-20.sh must be applied on EE and CE (and probably ..0.0 as well). All other versions do not need the patch.

  • Where can I get this patch. The Magento site mentions the patch but doesn't provide a download possibility...
    – Badger
    Commented Jan 12, 2016 at 9:31
  • Good question. It was there before. Commented Jan 12, 2016 at 9:45
  • I did find it on another site, but I'm curious as to why it's not available on the Magento site
    – Badger
    Commented Jan 12, 2016 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.