VulnerabilityModified
CVE-2012-0876
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with…
MEDIUM 4.3EPSS 5.72%
Does this matter?
Lower severity and a low EPSS score (5.72%). Track it; it rarely justifies an emergency change on its own.
Description
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
- EPSS
- 5.72% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- libexpat project/libexpat · python/python · debian/debian linux · canonical/ubuntu linux · oracle/solaris · redhat/storage · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux workstation
- Source
- secalert@redhat.com
References
- http://bugs.python.org/issue13703#msg151870Issue Tracking, Third Party Advisory
- http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.htmlBroken Link, Mailing List
- http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.htmlBroken Link, Mailing List
- http://mail.libexpat.org/pipermail/expat-discuss/2012-March/002768.htmlBroken Link
- http://rhn.redhat.com/errata/RHSA-2012-0731.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0062.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2957.htmlThird Party Advisory
- http://secunia.com/advisories/49504Not Applicable
- http://secunia.com/advisories/51024Not Applicable
- http://secunia.com/advisories/51040Not Applicable
- http://sourceforge.net/projects/expat/files/expat/2.1.0/Release Notes, Third Party Advisory
- http://sourceforge.net/tracker/?func=detail&atid=110127&aid=3496608&group_id=10127Third Party Advisory
- http://www.debian.org/security/2012/dsa-2525Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:041Broken Link
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.htmlThird Party Advisory
- http://www.securityfocus.com/bid/52379Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-1527-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-1613-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-1613-2Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365Broken Link
- https://support.apple.com/HT205637Third Party Advisory
- https://www.tenable.com/security/tns-2016-20Third Party Advisory
- http://bugs.python.org/issue13703#msg151870Issue Tracking, Third Party Advisory
- http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.htmlBroken Link, Mailing List
- http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.htmlBroken Link, Mailing List
- http://mail.libexpat.org/pipermail/expat-discuss/2012-March/002768.htmlBroken Link
- http://rhn.redhat.com/errata/RHSA-2012-0731.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0062.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2957.htmlThird Party Advisory
- http://secunia.com/advisories/49504Not Applicable
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.