CVE-2012-0876

2012-07-0300:00:00

ubuntu.com

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.004 Low

EPSS

Percentile

73.9%

JSON

The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values
without restricting the ability to trigger hash collisions predictably,
which allows context-dependent attackers to cause a denial of service (CPU
consumption) via an XML file with many identifiers with the same value.

Bugs

Notes

Author	Note
jdstrand	RedHat issued https://rhn.redhat.com/errata/RHBA-2012-1250.html for python as a result of the added XML_SetHashSalt symbol
ebarretto	tla uses system expat as of 1.3.5+dfsg-15
rodrigo-zaiden	the vulnerable code was added in expat version 1.95.7, with commit https://github.com/libexpat/libexpat/commit/8650b04b libxmltok seems to use code based on expat version 1.2 and does not add this commit, so, it’s not affected.
ccdm94	cmake 3.20.5 and forward uses expat 2.2.10+.

OSVersionArchitecturePackageVersionFilename
ubuntu16.04noarchinsighttoolkit< anyUNKNOWN
ubuntu16.04noarchayttm< anyUNKNOWN
ubuntu23.10noarchaudacity< anyUNKNOWN
ubuntu22.04noarchmatanza< anyUNKNOWN
ubuntu18.04noarchmatanza< anyUNKNOWN
ubuntu20.04noarchmatanza< anyUNKNOWN
ubuntu16.04noarchmatanza< anyUNKNOWN
ubuntu23.10noarchmatanza< anyUNKNOWN
ubuntu16.04noarchcableswig< anyUNKNOWN
ubuntu18.04noarchcoin3< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	16.04	noarch	insighttoolkit	< any	UNKNOWN
ubuntu	16.04	noarch	ayttm	< any	UNKNOWN
ubuntu	23.10	noarch	audacity	< any	UNKNOWN
ubuntu	22.04	noarch	matanza	< any	UNKNOWN
ubuntu	18.04	noarch	matanza	< any	UNKNOWN
ubuntu	20.04	noarch	matanza	< any	UNKNOWN
ubuntu	16.04	noarch	matanza	< any	UNKNOWN
ubuntu	23.10	noarch	matanza	< any	UNKNOWN
ubuntu	16.04	noarch	cableswig	< any	UNKNOWN
ubuntu	18.04	noarch	coin3	< any	UNKNOWN