Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2012-0876: Expat XML parser can be slowed down by crafted files
CVE-2012-0876 · published 14 years ago
Summary
The XML parser library Expat, in versions earlier than 2.1.0, can be tricked into doing a lot of extra work when it reads specially crafted XML files. This can make programs that use the library, such as canonical/coin3, canonical/vnc4, canonical/ayttm, canonical/cableswig, and canonical/cadaver, run very slowly or become unresponsive. Updating the software to a version that includes the fix, or applying the provided security patch, will prevent this slowdown.
What to do
- Update debian expat to version 2.1.0~beta3-1.
- Update debian xmlrpc-c to version 1.16.33-3.2.
- Update libexpat_project libexpat to version 2.1.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:14.04:LTS | canonical | coin3 | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | vnc4 | All versions |
| Ubuntu:16.04:LTS | canonical | ayttm | All versions |
| Ubuntu:16.04:LTS | canonical | cableswig | All versions |
| Ubuntu:16.04:LTS | canonical | cadaver | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | coin3 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | insighttoolkit | All versions |
| Ubuntu:16.04:LTS | canonical | matanza | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | swish-e | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | vnc4 | All versions |
| Ubuntu:18.04:LTS | canonical | cadaver | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | coin3 | All versions |
| Ubuntu:18.04:LTS | canonical | matanza | All versions |
| Ubuntu:Pro:18.04:LTS | canonical | swish-e | All versions |
| Ubuntu:18.04:LTS | canonical | vnc4 | All versions |
| Ubuntu:20.04:LTS | canonical | cadaver | All versions |
| Ubuntu:20.04:LTS | canonical | matanza | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | swish-e | All versions |
| Ubuntu:22.04:LTS | canonical | cadaver | All versions |
| Ubuntu:22.04:LTS | canonical | matanza | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | swish-e | All versions |
| Ubuntu:24.04:LTS | canonical | cadaver | All versions |
| Ubuntu:24.04:LTS | canonical | matanza | All versions |
| Ubuntu:Pro:24.04:LTS | canonical | swish-e | All versions |
| Ubuntu:25.10 | canonical | cadaver | All versions |
| Ubuntu:25.10 | canonical | matanza | All versions |
| Ubuntu:25.10 | canonical | paraview | All versions |
| Ubuntu:25.10 | canonical | sitecopy | All versions |
| Ubuntu:25.10 | canonical | swish-e | All versions |
| Ubuntu:26.04 | canonical | cadaver | All versions |
| Ubuntu:26.04 | canonical | matanza | All versions |
| Ubuntu:26.04 | canonical | paraview | All versions |
| Ubuntu:26.04 | canonical | sitecopy | All versions |
| Ubuntu:Pro:26.04:LTS | canonical | swish-e | All versions |
| Debian:12 | debian | expat |
< 2.1.0~beta3-1 Fix: upgrade to 2.1.0~beta3-1
|
| Debian:13 | debian | expat |
< 2.1.0~beta3-1 Fix: upgrade to 2.1.0~beta3-1
|
| Debian:14 | debian | expat |
< 2.1.0~beta3-1 Fix: upgrade to 2.1.0~beta3-1
|
| Debian:12 | debian | libxmltok | All versions |
| Debian:12 | debian | xmlrpc-c |
< 1.16.33-3.2 Fix: upgrade to 1.16.33-3.2
|
| Debian:13 | debian | xmlrpc-c |
< 1.16.33-3.2 Fix: upgrade to 1.16.33-3.2
|
| Debian:14 | debian | xmlrpc-c |
< 1.16.33-3.2 Fix: upgrade to 1.16.33-3.2
|
| – | libexpat_project | libexpat |
< 2.1.0 cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* |
| – | python | python |
>= 2.6.0, < 2.6.8 >= 2.7.0, < 2.7.3 >= 3.1.0, < 3.1.5 >= 3.2.0, < 3.2.3 cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
6.0 7.0 cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
8.04 10.04 11.04 11.10 12.04 cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:* |
| – | oracle | solaris |
11.3 cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:* |
| – | redhat | storage |
2.0 cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_desktop |
5.0 6.0 cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_eus |
6.2 cpe:2.3:o:redhat:enterprise_linux_eus:6.2:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_server |
5.0 6.0 cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* |
Showing 50 of 52. Show the rest
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | redhat | enterprise_linux_server_aus |
6.2 cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_workstation |
5.0 6.0 cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* |
Original advisory text
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a de...
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.
References
- https://ubuntu.com/security/CVE-2012-0876 Third Party Advisory
- http://blog.gmane.org/gmane.text.xml.expat.bugs/month=20120301 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2012/03/09/1 Third Party Advisory
- https://rhn.redhat.com/errata/RHSA-2012-0731.html Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2012-0876 Vendor Advisory
- https://ubuntu.com/security/notices/USN-1613-1 Vendor Advisory
- http://bugs.python.org/issue13703#msg151870 Issue Tracking Third Party Advisory
- http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html Broken Link Mailing List
- http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html Broken Link Mailing List
- http://mail.libexpat.org/pipermail/expat-discuss/2012-March/002768.html Broken Link
- http://rhn.redhat.com/errata/RHSA-2012-0731.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-0062.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2016-2957.html Third Party Advisory
- http://secunia.com/advisories/49504 Not Applicable
- http://secunia.com/advisories/51024 Not Applicable
- http://secunia.com/advisories/51040 Not Applicable
- http://sourceforge.net/projects/expat/files/expat/2.1.0/ Release Notes Third Party Advisory
- http://sourceforge.net/tracker/?func=detail&atid=110127&aid=3496608&group_id=101... Third Party Advisory
- http://www.debian.org/security/2012/dsa-2525 Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:041 Broken Link
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html Third Party Advisory
- http://www.securityfocus.com/bid/52379 Third Party Advisory VDB Entry
- http://www.ubuntu.com/usn/USN-1527-1 Third Party Advisory
- http://www.ubuntu.com/usn/USN-1613-1 Third Party Advisory
- http://www.ubuntu.com/usn/USN-1613-2 Third Party Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365 Broken Link
- https://support.apple.com/HT205637 Third Party Advisory
- https://www.tenable.com/security/tns-2016-20 Third Party Advisory
- https://ubuntu.com/security/notices/USN-1527-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-1527-2 Vendor Advisory
- https://ubuntu.com/security/notices/USN-1613-2 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2012-0876 Third Party Advisory
Severity
4.3
Medium
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published3 Jul 2012
Updated4 Nov 2026
First seen7 May 2026
Track software like this
Free during beta