CVE-2012-0876

Published: Jul 3, 2012Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.

Affected (22)

Products: Libexpat Project: Libexpat · Python: Python · Debian: Debian Linux · +3 more

Show all products

Libexpat Project: Libexpat · Python: Python · Debian: Debian Linux · Canonical: Ubuntu Linux · Oracle: Solaris · Redhat: Enterprise Linux Desktop, Enterprise Linux Eus, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Workstation, Storage

1 product

1 product

1 product

1 product

1 product

6 products

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Workstation

Storage

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Libexpat Project Libexpat	Before 2.1.0

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Python Python	From 2.6.0 to 2.6.8
Python Python	From 2.7.0 to 2.7.3
Python Python	From 3.1.0 to 3.1.5
Python Python	From 3.2.0 to 3.2.3

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 6.0
Debian Debian Linux	Version 7.0

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 11.04
Canonical Ubuntu Linux	Version 11.10
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 8.04

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Solaris	Version 11.3

Configuration F

9 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 5.0
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Eus	Version 6.2
Redhat Enterprise Linux Server	Version 5.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server Aus	Version 6.2
Redhat Enterprise Linux Workstation	Version 5.0
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Storage	Version 2.0

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (44)

http://bugs.python.org/issue13703#msg151870

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html

Source: secalert@redhat.com

Broken LinkMailing List

http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html

Source: secalert@redhat.com

Broken LinkMailing List

http://mail.libexpat.org/pipermail/expat-discuss/2012-March/002768.html

Source: secalert@redhat.com

Broken Link

http://rhn.redhat.com/errata/RHSA-2012-0731.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0062.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2957.html

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/49504

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/51024

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/51040

Source: secalert@redhat.com

Not Applicable

http://sourceforge.net/projects/expat/files/expat/2.1.0/

Source: secalert@redhat.com

Release NotesThird Party Advisory

http://sourceforge.net/tracker/?func=detail&atid=110127&aid=3496608&group_id=10127

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2012/dsa-2525

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2012:041

Source: secalert@redhat.com

Broken Link

http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/52379

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1527-1

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-1613-1

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-1613-2

Source: secalert@redhat.com

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10365

Source: secalert@redhat.com

Broken Link

https://support.apple.com/HT205637

Source: secalert@redhat.com

Third Party Advisory

https://www.tenable.com/security/tns-2016-20

Source: secalert@redhat.com

Third Party Advisory

http://bugs.python.org/issue13703#msg151870