Resource management error in expat - CVE-2012-0876

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33114

Resource management error in expat - CVE-2012-0876

Published: July 3, 2012 / Updated: August 3, 2020


Vulnerability identifier: #VU33114
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-0876
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.


Affected software

expat
Gentoo Linux
Amazon Linux AMI
Ubuntu
Slackware Linux
expat (Alpine package)
python2.5 (Ubuntu package)
python2.5-minimal (Ubuntu package)
HPE NonStop Virtual Tape Repository (VTR)
NetWorker Management Console

How to mitigate CVE-2012-0876

Install update from vendor's website.

expat - update to 2.1.0
expat (Alpine package) - update to 2.1.0-r0
python2.5 (Ubuntu package) - update to 2.5.2-2ubuntu6.2
python2.5-minimal (Ubuntu package) - update to 2.5.2-2ubuntu6.2
HPE NonStop Virtual Tape Repository (VTR) - update to T09644V01^AAK
NetWorker Management Console - update to 19.12.0.1

External References

Related Security Bulletins