A denial of service flaw was found in the implementation of hash arrays in Expat. An attacker could use this flaw to make an application using Expat consume an excessive amount of CPU time by providing a specially crafted XML file that triggers multiple hash function collisions. To mitigate this issue, randomization has been added to the hash function to reduce the chance of an attacker successfully causing intentional collisions. (CVE-2012-0876)

A memory leak flaw was found in Expat. If an XML file processed by an application linked against Expat triggered a memory re-allocation failure, Expat failed to free the previously allocated memory. This could cause the application to exit unexpectedly or crash when all available memory is exhausted. (CVE-2012-1148)

Updated expat packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Expat is a C library written by James Clark for parsing XML documents.

A denial of service flaw was found in the implementation of hash arrays in Expat. An attacker could use this flaw to make an application using Expat consume an excessive amount of CPU time by providing a specially crafted XML file that triggers multiple hash function collisions. To mitigate this issue, randomization has been added to the hash function to reduce the chance of an attacker successfully causing intentional collisions. (CVE-2012-0876)

A memory leak flaw was found in Expat. If an XML file processed by an application linked against Expat triggered a memory re-allocation failure, Expat failed to free the previously allocated memory. This could cause the application to exit unexpectedly or crash when all available memory is exhausted. (CVE-2012-1148)

All Expat users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, applications using the Expat library must be restarted for the update to take effect.

The following issues have been fixed :

  - expat was prone to a hash collision attack that could     lead to excessive CPU usage. (CVE-2012-0876)

  - expat didn't close file descriptors in some cases.
    (CVE-2012-1147)

  - specially crafted XML files could lead to a memory leak.
    (CVE-2012-1148)

USN-1527-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for XML-RPC for C and C++. Both issues described in the original advisory affected XML-RPC for C and C++ in Ubuntu 10.04 LTS, 11.04, 11.10 and 12.04 LTS.

It was discovered that Expat computed hash values without restricting the ability to trigger hash collisions predictably. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service by consuming excessive CPU resources. (CVE-2012-0876)

Tim Boddy discovered that Expat did not properly handle memory reallocation when processing XML files. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service by consuming excessive memory resources. This issue only affected Ubuntu 8.04 LTS, 10.04 LTS, 11.04 and 11.10.
(CVE-2012-1148).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of expat fixes the following bugs :

  - hash collision attack that could lead to exessive CPU     usage. (CVE-2012-0876)

  - expat didn't close file descriptors in some cases.
    (CVE-2012-1147)

  - specially crafted xml files could lead to a memory leak     (CVE-2012-1148)

The remote Solaris system is missing necessary patches to address security updates :

  - The XML parser (xmlparse.c) in expat before 2.1.0     computes hash values without restricting the ability to     trigger hash collisions predictably, which allows     context-dependent attackers to cause a denial of service     (CPU consumption) via an XML file with many identifiers     with the same value. (CVE-2012-0876)

  - Memory leak in the poolGrow function in     expat/lib/xmlparse.c in expat before 2.1.0 allows     context-dependent attackers to cause a denial of service     (memory consumption) via a large number of crafted XML     files that cause improperly-handled reallocation     failures when expanding entities. (CVE-2012-1148)

The version of Apple iTunes installed on the remote Windows host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

  - An information disclosure vulnerability exists in the     APNs server component due to client certificates being     transmitted in cleartext. A man-in-the-middle attacker     can exploit this to disclose sensitive information.
    (CVE-2017-2383)

  - A use-after-free error exists in the WebKit component     due to improper handling of RenderBox objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2463)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in the WebKit component due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2479,     CVE-2017-2480, CVE-2017-2493)

  - An integer overflow condition exists in the libxslt     component in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write, resulting in the     execution of arbitrary code. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7307-1 advisory.

    Tim Boddy discovered that Expat, contained within the xmltok library, did not properly handle memory     reallocation when processing XML files. If a user or application linked against Expat were tricked into     opening a crafted XML file, an attacker could cause a denial of service by consuming excessive memory     resources.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-     dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML     files that cause improperly-handled reallocation failures when expanding entities. (CVE-2012-1148)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

  - bind
  - expat
  - nspr and nss
  - python
  - vSphere API

USN-1613-1 fixed vulnerabilities in Python 2.5. This update provides the corresponding updates for Python 2.4.

It was discovered that Python would prepend an empty string to sys.path under certain circumstances. A local attacker with write access to the current working directory could exploit this to execute arbitrary code. (CVE-2008-5983)

It was discovered that the audioop module did not correctly perform input validation. If a user or automated system were tricked into opening a crafted audio file, an attacker could cause a denial of service via application crash.
(CVE-2010-1634, CVE-2010-2089)

Giampaolo Rodola discovered several race conditions in the smtpd module. A remote attacker could exploit this to cause a denial of service via daemon outage. (CVE-2010-3493)

It was discovered that the CGIHTTPServer module did not properly perform input validation on certain HTTP GET requests. A remote attacker could potentially obtain access to CGI script source files. (CVE-2011-1015)

Niels Heinen discovered that the urllib and urllib2 modules would process Location headers that specify a redirection to file: URLs. A remote attacker could exploit this to obtain sensitive information or cause a denial of service.
(CVE-2011-1521)

It was discovered that SimpleHTTPServer did not use a charset parameter in the Content-Type HTTP header. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 users. (CVE-2011-4940)

It was discovered that Python distutils contained a race condition when creating the ~/.pypirc file. A local attacker could exploit this to obtain sensitive information.
(CVE-2011-4944)

It was discovered that SimpleXMLRPCServer did not properly validate its input when handling HTTP POST requests. A remote attacker could exploit this to cause a denial of service via excessive CPU utilization. (CVE-2012-0845)

It was discovered that the Expat module in Python 2.5 computed hash values without restricting the ability to trigger hash collisions predictably. If a user or application using pyexpat were tricked into opening a crafted XML file, an attacker could cause a denial of service by consuming excessive CPU resources.
(CVE-2012-0876)

Tim Boddy discovered that the Expat module in Python 2.5 did not properly handle memory reallocation when processing XML files. If a user or application using pyexpat were tricked into opening a crafted XML file, an attacker could cause a denial of service by consuming excessive memory resources.
(CVE-2012-1148).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - AppSandbox
  - Bluetooth
  - CFNetwork HTTPProtocol
  - Compression
  - Configuration Profiles
  - CoreGraphics
  - CoreMedia Playback
  - Disk Images
  - EFI
  - File Bookmark
  - Hypervisor
  - iBooks
  - ImageIO
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit SCSI
  - IOThunderboltFamily
  - Kernel
  - kext tools
  - Keychain Access
  - libarchive
  - libc
  - libexpat
  - libxml2
  - OpenGL
  - OpenLDAP
  - OpenSSH
  - QuickLook
  - Sandbox
  - Security
  - System Integrity Protection

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

A memory leak and a hash table collision flaw in expat could cause denial os service (DoS) attacks (CVE-2012-0876, CVE-2012-1148).

The updated packages have been patched to correct this issue.

ID	名稱	產品	系列	已發布	已更新	嚴重性
69696	Amazon Linux AMI : expat (ALAS-2012-89)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2018/4/18	medium
59491	RHEL 5 / 6 : expat (RHSA-2012:0731)	Nessus	Red Hat Local Security Checks	2012/6/14	2021/1/14	medium
59639	SuSE 10 Security Update : expat (ZYPP Patch Number 8015)	Nessus	SuSE Local Security Checks	2012/6/21	2021/1/19	medium
62036	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : xmlrpc-c vulnerabilities (USN-1527-2)	Nessus	Ubuntu Local Security Checks	2012/9/11	2019/9/19	medium
64127	SuSE 11.1 Security Update : expat (SAT Patch Number 6200)	Nessus	SuSE Local Security Checks	2013/1/25	2021/1/19	medium
80669	Oracle Solaris Third-Party Patch Update : libexpat (multiple_resource_management_error_vulnerabilities)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
100025	Apple iTunes < 12.6 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	2017/5/8	2026/10/12	critical
216880	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : xmltok library vulnerability (USN-7307-1)	Nessus	Ubuntu Local Security Checks	2025/2/27	2025/3/4	high
217585	Linux Distros Unpatched Vulnerability : CVE-2012-1148	Nessus	Misc.	2025/3/4	2026/11/5	high
89039	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2012-0016) (remote check)	Nessus	Misc.	2016/2/29	2021/1/6	high
62620	Ubuntu 8.04 LTS : python2.4 vulnerabilities (USN-1613-2)	Nessus	Ubuntu Local Security Checks	2012/10/18	2019/9/19	medium
87314	Mac OS X 10.11.x < 10.11.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2015/12/10	2024/5/28	critical
58506	Mandriva Linux Security Advisory : expat (MDVSA-2012:041)	Nessus	Mandriva Local Security Checks	2012/3/28	2021/1/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

critical

high

high

high

medium

critical

medium