CVE-2012-1148
CVE-2012-1148
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.
EPSS 3.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
expat Debian:12
- Affected ranges
- ECOSYSTEM: < 2.1.0~beta3-1
Update to 2.1.0~beta3-1
expat Debian:13
- Affected ranges
- ECOSYSTEM: < 2.1.0~beta3-1
Update to 2.1.0~beta3-1
expat Debian:14
- Affected ranges
- ECOSYSTEM: < 2.1.0~beta3-1
Update to 2.1.0~beta3-1
libxmltok Debian:12
- Versions
- 1.2-4
- 1.2-4.1
- 1.2-4.1~exp1
- 1.2-4.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xmlrpc-c Debian:12
- Affected ranges
- ECOSYSTEM: < 1.16.33-3.2
Update to 1.16.33-3.2
xmlrpc-c Debian:13
- Affected ranges
- ECOSYSTEM: < 1.16.33-3.2
Update to 1.16.33-3.2
xmlrpc-c Debian:14
- Affected ranges
- ECOSYSTEM: < 1.16.33-3.2
Update to 1.16.33-3.2
coin3 Ubuntu:Pro:14.04:LTS
- Versions
- 3.1.4~abc9f50-3
- 3.1.4~abc9f50-4
- 3.1.4~abc9f50-4ubuntu2
- 3.1.4~abc9f50-4ubuntu2+esm1
- 3.1.4~abc9f50-4ubuntu2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vnc4 Ubuntu:Pro:14.04:LTS
- Versions
- 4.1.1+xorg4.3.0-37ubuntu5
- 4.1.1+xorg4.3.0-37ubuntu5.0.1
- 4.1.1+xorg4.3.0-37ubuntu5.0.2
- 4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libxmltok Ubuntu:Pro:16.04:LTS
- Versions
- 1.2-3build3
- 1.2-3ubuntu0.16.04.1~esm1
- Affected ranges
- ECOSYSTEM: < 1.2-3ubuntu0.16.04.1~esm2
Update to 1.2-3ubuntu0.16.04.1~esm2
ayttm Ubuntu:Pro:16.04:LTS
- Versions
- 0.6.3-3build1
- 0.6.3-3ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cableswig Ubuntu:Pro:16.04:LTS
- Versions
- 0.1.0+git20150808-1
- 0.1.0+git20150808-2
- 0.1.0+git20150808-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cadaver Ubuntu:16.04:LTS
- Versions
- 0.23.3-2ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
coin3 Ubuntu:Pro:16.04:LTS
- Versions
- 3.1.4~abc9f50+dfsg1-1
- 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1
- 3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
insighttoolkit Ubuntu:Pro:16.04:LTS
- Versions
- 3.20.1+git20120521-6
- 3.20.1+git20120521-6build1
- 3.20.1+git20120521-6ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
matanza Ubuntu:16.04:LTS
- Versions
- 0.13+ds1-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
swish-e Ubuntu:Pro:16.04:LTS
- Versions
- 2.4.7-4
- 2.4.7-4build1
- 2.4.7-4ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
vnc4 Ubuntu:Pro:16.04:LTS
- Versions
- 4.1.1+xorg4.3.0-37.3ubuntu2
- 4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cadaver Ubuntu:18.04:LTS
- Versions
- 0.23.3-2ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
coin3 Ubuntu:Pro:18.04:LTS
- Versions
- 3.1.4~abc9f50+dfsg1-2
- 3.1.4~abc9f50+dfsg2-1
- 3.1.4~abc9f50+dfsg3-1
- 3.1.4~abc9f50+dfsg3-2
- 3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libxmltok Ubuntu:Pro:18.04:LTS
- Versions
- 1.2-4
- 1.2-4ubuntu0.18.04.1~esm1
- 1.2-4ubuntu0.18.04.1~esm2
- 1.2-4ubuntu0.18.04.1~esm3
- 1.2-4ubuntu0.18.04.1~esm4
- Affected ranges
- ECOSYSTEM: < 1.2-4ubuntu0.18.04.1~esm5
Update to 1.2-4ubuntu0.18.04.1~esm5
matanza Ubuntu:18.04:LTS
- Versions
- 0.13+ds1-5build1
- 0.13+ds1-6
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
swish-e Ubuntu:Pro:18.04:LTS
- Versions
- 2.4.7-5ubuntu1
- 2.4.7-5ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- http://secunia.com/advisories/49504
- http://www.ubuntu.com/usn/USN-1527-1
- https://support.apple.com/HT205637
- http://www.securitytracker.com/id/1034344
- http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.166&r2=1.167
- http://secunia.com/advisories/51040
- http://rhn.redhat.com/errata/RHSA-2012-0731.html
- http://www.securityfocus.com/bid/52379
- http://sourceforge.net/projects/expat/files/expat/2.1.0/
- http://rhn.redhat.com/errata/RHSA-2016-0062.html
- http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html
- http://www.debian.org/security/2012/dsa-2525
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:041
- http://sourceforge.net/tracker/?func=detail&atid=110127&aid=2958794&group_id=10127
- http://rhn.redhat.com/errata/RHSA-2016-2957.html
- http://www.ubuntu.com/usn/USN-1613-2
- http://secunia.com/advisories/51024
- http://www.ubuntu.com/usn/USN-1613-1
- https://nvd.nist.gov/vuln/detail/CVE-2012-1148