CVE-2012-1148

Published: Jul 3, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.

Affected (10)

Products: Libexpat Project: Libexpat · Apple: Mac Os X

Libexpat Project

1 product

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Libexpat Project Libexpat	Up to 2.0.1
Libexpat Project Libexpat	Version 1.95.1
Libexpat Project Libexpat	Version 1.95.2
Libexpat Project Libexpat	Version 1.95.4
Libexpat Project Libexpat	Version 1.95.5
Libexpat Project Libexpat	Version 1.95.6
Libexpat Project Libexpat	Version 1.95.7
Libexpat Project Libexpat	Version 1.95.8
Libexpat Project Libexpat	Version 2.0.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Up to 10.11.1

Related CWEs

References (36)

http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.166&r2=1.167

Source: secalert@redhat.com

Patch

http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0731.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0062.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-2957.html

Source: secalert@redhat.com

http://secunia.com/advisories/49504

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/51024

Source: secalert@redhat.com

http://secunia.com/advisories/51040

Source: secalert@redhat.com

http://sourceforge.net/projects/expat/files/expat/2.1.0/

Source: secalert@redhat.com

http://sourceforge.net/tracker/?func=detail&atid=110127&aid=2958794&group_id=10127

Source: secalert@redhat.com

http://www.debian.org/security/2012/dsa-2525

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2012:041

Source: secalert@redhat.com

http://www.securityfocus.com/bid/52379

Source: secalert@redhat.com

http://www.securitytracker.com/id/1034344

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1527-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1613-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1613-2

Source: secalert@redhat.com

https://support.apple.com/HT205637

Source: secalert@redhat.com

http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.166&r2=1.167

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-0731.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2016-0062.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2016-2957.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/49504

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/51024

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/51040

Source: af854a3a-2127-422b-91ae-364da2661108

http://sourceforge.net/projects/expat/files/expat/2.1.0/

Source: af854a3a-2127-422b-91ae-364da2661108

http://sourceforge.net/tracker/?func=detail&atid=110127&aid=2958794&group_id=10127

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2012/dsa-2525

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2012:041

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/52379

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1034344

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1527-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1613-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1613-2

Source: af854a3a-2127-422b-91ae-364da2661108

https://support.apple.com/HT205637

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.