Fluid Attacks Database

Description

Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.2	expat	>=0 <2.2.0-r0	2.2.0-r0
debian 12	libxmltok	=1.2-4 \|\| =1.2-4.1 \|\| =1.2-4.1~exp1 \|\| =1.2-4.2	-
debian 11	expat	>=0 <2.1.1-3	2.1.1-3
alpine v3.3	expat	>=0 <2.2.0-r0	2.2.0-r0
debian 14	expat	>=0 <2.1.1-3	2.1.1-3
debian 11	libxmltok	=1.2-4 \|\| =1.2-4.1 \|\| =1.2-4.1~exp1 \|\| =1.2-4.2	-
debian 13	expat	>=0 <2.1.1-3	2.1.1-3
alpine v3.4	expat	>=0 <2.2.0-r0	2.2.0-r0
debian 12	expat	>=0 <2.1.1-3	2.1.1-3
rpm rhel5	expat	-	-

1-10 of 13

Aliases

1. CVE-2012-67022. NVD-2012-67023. OSV-ALPINE-2012-67024. OSV-2012-67025. OSV-DEBIAN-2012-67026. SECURITY-CVE-2012-67027. SECURITY-TRACKER-CVE-2012-6702

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.