CVEvulnerability
CVE-2012-1148
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-07-03
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-399
Description
Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.
Affected configurations
• libexpat project libexpat (<= 2.0.1)
• libexpat project libexpat 1.95.1
• libexpat project libexpat 1.95.2
• libexpat project libexpat 1.95.4
• libexpat project libexpat 1.95.5
• libexpat project libexpat 1.95.6
• libexpat project libexpat 1.95.7
• libexpat project libexpat 1.95.8
• libexpat project libexpat 2.0.0
• apple mac os x (<= 10.11.1)
Related
Weakness · not in database (1)
References
- http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.166&r2=1.167 Patch
- http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html lists.apple.com
- http://rhn.redhat.com/errata/RHSA-2012-0731.html rhn.redhat.com
- http://rhn.redhat.com/errata/RHSA-2016-0062.html rhn.redhat.com
- http://rhn.redhat.com/errata/RHSA-2016-2957.html rhn.redhat.com
- http://secunia.com/advisories/49504 Vendor Advisory
- http://secunia.com/advisories/51024 secunia.com
- http://secunia.com/advisories/51040 secunia.com
- http://sourceforge.net/projects/expat/files/expat/2.1.0/ sourceforge.net
- http://sourceforge.net/tracker/?func=detail&atid=110127&aid=2958794&group_id=10127 sourceforge.net
- http://www.debian.org/security/2012/dsa-2525 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:041 www.mandriva.com
- http://www.securityfocus.com/bid/52379 www.securityfocus.com
- http://www.securitytracker.com/id/1034344 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-1527-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-1613-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-1613-2 www.ubuntu.com
- https://support.apple.com/HT205637 support.apple.com
- http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.166&r2=1.167 Patch
- http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html lists.apple.com
- http://rhn.redhat.com/errata/RHSA-2012-0731.html rhn.redhat.com
- http://rhn.redhat.com/errata/RHSA-2016-0062.html rhn.redhat.com
- http://rhn.redhat.com/errata/RHSA-2016-2957.html rhn.redhat.com
- http://secunia.com/advisories/49504 Vendor Advisory
- http://secunia.com/advisories/51024 secunia.com
- http://secunia.com/advisories/51040 secunia.com
- http://sourceforge.net/projects/expat/files/expat/2.1.0/ sourceforge.net
- http://sourceforge.net/tracker/?func=detail&atid=110127&aid=2958794&group_id=10127 sourceforge.net
- http://www.debian.org/security/2012/dsa-2525 www.debian.org
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:041 www.mandriva.com
- http://www.securityfocus.com/bid/52379 www.securityfocus.com
- http://www.securitytracker.com/id/1034344 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-1527-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-1613-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-1613-2 www.ubuntu.com
- https://support.apple.com/HT205637 support.apple.com