Lucene search
Ubuntu.comUB:CVE-2012-6702HistoryDec 31, 2012 - 12:00 a.m.
CVE-2012-6702
2012-12-3100:00:00
ubuntu.com
ubuntu.com
19
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
5.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
0.004
Percentile
74.2%
Expat, when used in a parser that has not called XML_SetHashSalt or passed
it a seed of 0, makes it easier for context-dependent attackers to defeat
cryptographic protection mechanisms via vectors involving use of the srand
function.
Bugs
- <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6702>
- <https://bugzilla.redhat.com/show_bug.cgi?id=1197087>
- <https://sourceforge.net/p/expat/bugs/499/>
Notes
| Author | Note |
|---|---|
| sbeattie | tla uses system expat as of 1.3.5+dfsg-15 |
| rodrigo-zaiden | related to CVE-2012-0876, where the fix added XML_SetHashSalt and generate_hash_secret_salt methods. libxmltok does not have those methods, hence not affected. |
| ccdm94 | cmake 3.20.5 and forward uses expat 2.2.10+. |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 24.04 | noarch | audacity | < any | UNKNOWN |
| ubuntu | 12.04 | noarch | expat | < 2.0.1-7.2ubuntu1.4 | UNKNOWN |
| ubuntu | 14.04 | noarch | expat | < 2.1.0-4ubuntu1.3 | UNKNOWN |
| ubuntu | 15.10 | noarch | expat | < 2.1.0-7ubuntu0.15.10.2 | UNKNOWN |
| ubuntu | 16.04 | noarch | expat | < 2.1.0-7ubuntu0.16.04.2 | UNKNOWN |
| ubuntu | 16.04 | noarch | insighttoolkit | < any | UNKNOWN |
| ubuntu | 18.04 | noarch | xmlrpc-c | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | xmlrpc-c | < any | UNKNOWN |
| ubuntu | 22.04 | noarch | xmlrpc-c | < any | UNKNOWN |
| ubuntu | 24.04 | noarch | xmlrpc-c | < any | UNKNOWN |
Related
openvas
openvas
Debian Security Advisory DSA 3597-1 (expat - security update)
2016-06-07 00:00:00
SUSE: Security Advisory (SUSE-SU-2017:0424-1)
2021-04-19 00:00:00
Mageia: Security Advisory (MGASA-2016-0227)
2022-01-28 00:00:00
nessus
nessus
openSUSE Security Update : expat (openSUSE-2017-260)
2017-02-21 00:00:00
Debian DLA-508-1 : expat security update
2016-06-09 00:00:00
SUSE SLES11 Security Update : expat (SUSE-SU-2017:0415-1)
2017-02-08 00:00:00
archlinux
archlinux
expat: multiple issues
2016-06-13 00:00:00
lib32-expat: multiple issues
2016-06-13 00:00:00
mageia
mageia
Updated expat packages fix security vulnerabilities
2016-06-17 08:58:14
debian
debian
[SECURITY] [DLA 508-1] expat security update
2016-06-08 09:29:13
[SECURITY] [DSA 3597-1] expat security update
2016-06-07 16:44:57
[SECURITY] [DSA 3597-1] expat security update
2016-06-07 16:44:57
freebsd
freebsd
expat -- multiple vulnerabilities
2016-03-18 00:00:00
Python 2.7 -- multiple vulnerabilities
2017-08-26 00:00:00
python 2.7 -- multiple vulnerabilities
2018-05-01 00:00:00
ubuntucve
ubuntucve
CVE-2016-5300
2016-06-06 00:00:00
CVE-2012-0876
2012-07-03 00:00:00
osv
osv
expat - security update
2016-06-08 00:00:00
expat - security update
2016-06-07 00:00:00
CVE-2012-6702
2016-06-16 18:59:00
debiancve
debiancve
prion
prion
Design/Logic Flaw
2016-06-16 18:59:00
Code injection
2012-07-03 19:55:00
Code injection
2016-06-16 18:59:00
cvelist
cvelist
nvd
nvd
cve
cve
ibm
ibm
alpinelinux
alpinelinux
CVE-2012-6702
2016-06-16 18:59:00
CVE-2016-5300
2016-06-16 18:59:10
veracode
veracode
Weak Cryptographic Protection
2016-06-08 07:23:46
Denial Of Service (DoS)
2019-01-15 08:52:02
Denial Of Service (DoS)
2019-05-02 04:41:51
f5
f5
SOL65460334 - Expat XML parser vulnerability CVE-2012-6702
2016-09-06 00:00:00
K65460334 : Expat XML parser vulnerability CVE-2012-6702
2016-09-06 00:00:00
SOL70938105 - Expat XML library vulnerability CVE-2016-5300
2016-10-26 00:00:00
fedora
fedora
[SECURITY] Fedora 15 Update: expat-2.1.0-1.fc15
2012-05-15 23:27:15
[SECURITY] Fedora 16 Update: expat-2.1.0-1.fc16
2012-05-01 00:51:58
[SECURITY] Fedora 17 Update: expat-2.1.0-1.fc17
2012-04-12 03:36:59
ubuntu
ubuntu
Expat vulnerabilities
2016-06-20 00:00:00
XML-RPC for C and C++ vulnerabilities
2012-09-10 00:00:00
Expat vulnerabilities
2012-08-10 00:00:00
cloudfoundry
cloudfoundry
USN-3010-1 Expat vulnerabilities | Cloud Foundry
2016-07-13 00:00:00
centos
centos
expat security update
2012-06-13 17:07:10
amazon
amazon
Medium: expat
2012-06-19 15:59:00
oraclelinux
oraclelinux
expat security update
2012-06-13 00:00:00
python security update
2012-06-18 00:00:00
python security update
2012-06-18 00:00:00
securityvulns
securityvulns
expat security vulnerability
2012-04-02 00:00:00
[ MDVSA-2012:041 ] expat
2012-04-02 00:00:00
[ MDVSA-2012:096-1 ] python
2012-07-09 00:00:00
redhatcve
redhatcve
CVE-2016-5300
2016-06-06 13:18:38
redhat
redhat
(RHSA-2012:0731) Moderate: expat security update
2012-06-13 00:00:00
(RHSA-2016:0062) Moderate: Red Hat JBoss Web Server 2.1.0 security update
2016-01-21 15:45:11
gentoo
gentoo
Expat: Multiple vulnerabilities
2012-09-24 00:00:00
Expat: Multiple vulnerabilities
2017-01-11 00:00:00
slackware
slackware
[slackware-security] expat
2016-12-24 19:24:21
[slackware-security] python
2018-05-04 20:53:50
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
5.9
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
0.004
Percentile
74.2%
Related for UB:CVE-2012-6702