Vulnerability Name:

CVE-2012-0841 (CCN-73378)

Assigned:2012-02-21
Published:2012-02-21
Updated:2023-02-13
Summary:libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (REDHAT CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-407
Vulnerability Consequences:Denial of Service
References:Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: MITRE
Type: CNA
CVE-2012-0841

Source: CCN
Type: GNOME GIT Repository
libxml2

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: RHSA-2012-0324
Moderate: libxml2 security update

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: RHSA-2013-0217
Important: mingw32-libxml2 security update

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: SA48000
libxml2 Hash Collision Denial of Service Vulnerability

Source: CCN
Type: SA49858
VMware ESXi libxml2 Multiple Vulnerabilities

Source: CCN
Type: SA49930
VMware ESXi libxml2 Multiple Vulnerabilities

Source: CCN
Type: SA50614
Avaya Voice Portal Multiple Vulnerabilities

Source: CCN
Type: SA50712
Avaya Application Enablement Services Two Vulnerabilities

Source: CCN
Type: SA51373
Oracle Solaris Libxml2 Multiple Vulnerabilities

Source: CCN
Type: SA54886
Apple iOS Multiple Vulnerabilities

Source: CCN
Type: SA55442
Apple iTunes Multiple Vulnerabilities

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: Apple Web site
About the security content of iOS 7

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: DEBIAN
Type: DSA-2417
libxml2 -- computational denial of service

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: Oracle Web site
Oracle Critical Patch Update Advisory - April 2013

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: OSVDB ID: 79437
libxml2 Hash Collision Form Parameter Parsing Remote DoS

Source: CCN
Type: BID-52107
libxml2 Hash Collision Denial Of Service Vulnerability

Source: secalert@redhat.com
Type: Patch
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: XMLsoft Web site
Libxml2

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: Red Hat Bugzilla Bug 787067
CVE-2012-0841 libxml2: hash table collisions CPU usage DoS

Source: CCN
Type: ASA-2011-154
apr security update (RHSA-2011-0507)

Source: CCN
Type: ASA-2012-139
libxml2 security update (RHSA-2012-0324)

Source: XF
Type: UNKNOWN
libxml2-hash-dos(73378)

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*
    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:5::client_workstation:*:*:*:*:*
    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*
    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*
    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*
    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:6::computenode:*:*:*:*:*
    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*
    • Configuration RedHat 9:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:xmlsoft:libxml2:2.7.8:*:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/o:oracle:solaris:11_express:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6:*:server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6:*:workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_hpc_node:6:*:*:*:*:*:*:*
  • OR cpe:/a:oracle:http_server:-:*:*:*:*:*:*:*
  • OR cpe:/a:apple:itunes:11.1.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:42389
    P
    		Security update for kernel-firmware (Moderate)
    2022-05-25
    oval:org.opensuse.security:def:20120841
    V
    		CVE-2012-0841
    2022-05-20
    oval:org.opensuse.security:def:31709
    P
    		Security update for java-1_8_0-openjdk (Important)
    2021-11-23
    oval:org.opensuse.security:def:32225
    P
    		Security update for postgresql10 (Important)
    2021-11-22
    oval:org.opensuse.security:def:26162
    P
    		Security update for pcre (Moderate)
    2021-11-10
    oval:org.opensuse.security:def:31698
    P
    		Security update for transfig (Important)
    2021-10-29
    oval:org.opensuse.security:def:31697
    P
    		Security update for opensc (Important)
    2021-10-29
    oval:org.opensuse.security:def:32203
    P
    		Security update for the Linux Kernel (Live Patch 40 for SLE 12 SP3) (Important)
    2021-10-18
    oval:org.opensuse.security:def:26134
    P
    		Security update for the Linux Kernel (Important)
    2021-09-23
    oval:org.opensuse.security:def:26109
    P
    		Security update for unrar (Moderate)
    2021-08-25
    oval:org.opensuse.security:def:32164
    P
    		Security update for java-1_8_0-openjdk (Important)
    2021-08-20
    oval:org.opensuse.security:def:31667
    P
    		Security update for fetchmail (Moderate)
    2021-08-18
    oval:org.opensuse.security:def:32151
    P
    		Security update for the Linux Kernel (Live Patch 39 for SLE 12 SP3) (Important)
    2021-07-27
    oval:org.opensuse.security:def:32946
    P
    		Security update for freeradius-server (Moderate)
    2021-06-11
    oval:org.opensuse.security:def:42638
    P
    		libxml2-2.7.6-0.31.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36231
    P
    		libxml2-2.7.6-0.31.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36509
    P
    		libxml2-devel-2.7.6-0.31.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:26070
    P
    		Security update for spice (Important)
    2021-06-08
    oval:org.opensuse.security:def:32115
    P
    		Security update for spice (Important)
    2021-06-08
    oval:org.opensuse.security:def:26065
    P
    		Security update for polkit (Important)
    2021-06-03
    oval:org.opensuse.security:def:26058
    P
    		Security update for postgresql10 (Moderate)
    2021-05-27
    oval:org.opensuse.security:def:26059
    P
    		Security update for postgresql12 (Moderate)
    2021-05-27
    oval:org.opensuse.security:def:32907
    P
    		Security update for gdm (Important)
    2021-04-28
    oval:org.opensuse.security:def:32064
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-04-07
    oval:org.opensuse.security:def:32059
    P
    		Security update for the Linux Kernel (Live Patch 31 for SLE 12 SP3) (Important)
    2021-04-07
    oval:org.opensuse.security:def:26211
    P
    		Security update for glib2 (Important)
    2021-03-16
    oval:org.opensuse.security:def:26206
    P
    		Security update for the Linux Kernel (Important)
    2021-03-09
    oval:org.opensuse.security:def:32269
    P
    		Security update for the Linux Kernel (Important)
    2021-03-09
    oval:org.opensuse.security:def:26122
    P
    		Security update for python-urllib3 (Moderate)
    2021-02-03
    oval:org.opensuse.security:def:25984
    P
    		Security update for cyrus-sasl (Important)
    2020-12-28
    oval:org.opensuse.security:def:32007
    P
    		Security update for the Linux Kernel (Live Patch 30 for SLE 12 SP3) (Important)
    2020-12-07
    oval:org.opensuse.security:def:35982
    P
    		libxml2-2.7.6-0.23.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:26357
    P
    		Security update for enigmail (Important)
    2020-12-01
    oval:org.opensuse.security:def:26556
    P
    		gmime on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26343
    P
    		Security update for MozillaThunderbird (Important)
    2020-12-01
    oval:org.opensuse.security:def:32451
    P
    		Security update for xen (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25736
    P
    		Security update for mozilla-nspr, mozilla-nss (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26737
    P
    		libadns1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31461
    P
    		Security update for postgresql94 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27507
    P
    		libxml2-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25781
    P
    		Security update for libqt4 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31903
    P
    		Security update for fontconfig (Low)
    2020-12-01
    oval:org.opensuse.security:def:26946
    P
    		libecpg6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31915
    P
    		Security update for gd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26498
    P
    		Security update for nextcloud (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32363
    P
    		Security update for sudo (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25544
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26635
    P
    		quagga on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33155
    P
    		libicu-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31449
    P
    		Security update for postgresql10 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25958
    P
    		Security update for libwpd (Important)
    2020-12-01
    oval:org.opensuse.security:def:26834
    P
    		tomcat6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31759
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:26264
    P
    		Security update for gegl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26410
    P
    		Security update for freexl (Important)
    2020-12-01
    oval:org.opensuse.security:def:27194
    P
    		liblzo2-2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25532
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26400
    P
    		Security update for Chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:32473
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:25817
    P
    		Security update for pidgin-otr (Important)
    2020-12-01
    oval:org.opensuse.security:def:26776
    P
    		libzip1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31535
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:25792
    P
    		Security update for libvirt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26981
    P
    		libxml2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26512
    P
    		Security update for pdns-recursor (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26262
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:32412
    P
    		Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25608
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26688
    P
    		ecryptfs-utils-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33194
    P
    		libxml2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31450
    P
    		Security update for postgresql10 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27472
    P
    		libpng-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25780
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31816
    P
    		Security update for apport (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26308
    P
    		Security update for python modules (Low)
    2020-12-01
    oval:org.opensuse.security:def:31783
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:26459
    P
    		Security update for chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:32307
    P
    		Security update for python (Important)
    2020-12-01
    oval:org.opensuse.security:def:27229
    P
    		libxml2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25533
    P
    		Security update for ed (Low)
    2020-12-01
    oval:org.opensuse.security:def:26484
    P
    		Security update for chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:32517
    P
    		g3utils on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25874
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:26790
    P
    		ofed on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26250
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:25856
    P
    		Security update for gd (Important)
    2020-12-01
    oval:org.mitre.oval:def:25457
    P
    		SUSE-SU-2013:1627-1 -- Security update for libxml2
    2014-09-08
    oval:org.mitre.oval:def:25714
    P
    		SUSE-SU-2013:1625-1 -- Security update for libxml2
    2014-09-08
    oval:org.mitre.oval:def:15454
    P
    		USN-1376-1 -- libxml2 vulnerability
    2014-06-30
    oval:org.mitre.oval:def:14887
    P
    		DSA-2417-1 libxml2 -- computational denial of service
    2014-06-23
    oval:org.mitre.oval:def:23733
    P
    		ELSA-2012:0324: libxml2 security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:23888
    P
    		ELSA-2013:0217: mingw32-libxml2 security update (Important)
    2014-05-26
    oval:org.mitre.oval:def:20976
    P
    		RHSA-2012:0324: libxml2 security update (Moderate)
    2014-02-24
    oval:org.mitre.oval:def:20771
    P
    		RHSA-2013:0217: mingw32-libxml2 security update (Important)
    2014-02-17
    oval:org.mitre.oval:def:20110
    V
    		VMware vSphere and vCOps updates to third party libraries
    2014-01-20
    oval:com.redhat.rhsa:def:20130217
    P
    		RHSA-2013:0217: mingw32-libxml2 security update (Important)
    2013-01-31
    oval:com.redhat.rhsa:def:20120324
    P
    		RHSA-2012:0324: libxml2 security update (Moderate)
    2012-02-21
    BACK
    xmlsoft libxml2 2.7.8
    redhat enterprise linux 5
    redhat enterprise linux 5
    redhat enterprise linux 5
    oracle solaris 11_express
    redhat enterprise linux 6
    redhat enterprise linux 6
    redhat enterprise linux desktop 6
    redhat enterprise linux hpc node 6
    oracle http server -
    apple itunes 11.1.1