Fluid Attacks Database

Description

The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	libxmltok	=1.2-4 \|\| =1.2-4.1 \|\| =1.2-4.1~exp1 \|\| =1.2-4.2	-
debian 11	xmlrpc-c	>=0 <1.16.33-3.2	1.16.33-3.2
debian 12	xmlrpc-c	>=0 <1.16.33-3.2	1.16.33-3.2
debian 11	expat	>=0 <2.1.0~beta3-1	2.1.0~beta3-1
debian 13	expat	>=0 <2.1.0~beta3-1	2.1.0~beta3-1
debian 14	expat	>=0 <2.1.0~beta3-1	2.1.0~beta3-1
debian 11	libxmltok	=1.2-4 \|\| =1.2-4.1 \|\| =1.2-4.1~exp1 \|\| =1.2-4.2	-
debian 14	xmlrpc-c	>=0 <1.16.33-3.2	1.16.33-3.2
debian 12	expat	>=0 <2.1.0~beta3-1	2.1.0~beta3-1
debian 13	xmlrpc-c	>=0 <1.16.33-3.2	1.16.33-3.2

1-10 of 15

Aliases

1. CVE-2012-08762. NVD-2012-08763. OSV-DEBIAN-2012-08764. OSV-2012-08765. SECURITY-TRACKER-CVE-2012-0876

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.