CVE catalog

CVE-2012-0876

libxmltok: CVE-2012-0876

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
5.72% · Oct 25, 2026

The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianexpatsid2.9.0-1fixed
Debianexpatforky2.9.0-1fixed
Debianexpattrixie2.8.3-1~deb13u1fixed
Debianexpattrixie-security2.9.0-1~deb13u1fixed
Debianexpatbookworm2.5.0-1+deb12u2fixed
Debianexpatbookworm-security2.5.0-1+deb12u5fixed
Debianxmlrpc-csid1.60.05-1fixed
Debianxmlrpc-cforky1.60.05-1fixed
Debianxmlrpc-ctrixie1.59.03-10fixed
Debianxmlrpc-cbookworm1.33.14-11fixed
Debianlibxmltokbookworm1.2-4vulnerable
Susepython3hpe helion openstack 83.4.10-25.39.3fixed
Susepython3-basehpe helion openstack 83.4.10-25.39.2fixed
Susepython3openstack cloud 73.4.10-25.39.3fixed
Susepython3-baseopenstack cloud 73.4.10-25.39.2fixed
Susepython3openstack cloud 83.4.10-25.39.3fixed
Susepython3-baseopenstack cloud 83.4.10-25.39.2fixed
Susepython3openstack cloud crowbar 83.4.10-25.39.3fixed
Susepython3-baseopenstack cloud crowbar 83.4.10-25.39.2fixed
Susepython3linux enterprise desktop 12 sp43.4.10-25.39.3fixed
Susepython3-baselinux enterprise desktop 12 sp43.4.10-25.39.2fixed
Susepython3linux enterprise module for web and scripting 123.4.10-25.39.3fixed
Susepython3-baselinux enterprise module for web and scripting 123.4.10-25.39.2fixed
Susepython3linux enterprise server for sap applications 12 sp13.4.10-25.39.3fixed
Susepython3-baselinux enterprise server for sap applications 12 sp13.4.10-25.39.2fixed
Susepython3linux enterprise server for sap applications 12 sp23.4.10-25.39.3fixed
Susepython3-baselinux enterprise server for sap applications 12 sp23.4.10-25.39.2fixed
Susepython3linux enterprise server for sap applications 12 sp33.4.10-25.39.3fixed
Susepython3-baselinux enterprise server for sap applications 12 sp33.4.10-25.39.2fixed
Susepython3linux enterprise software development kit 12 sp43.4.10-25.39.3fixed
Susepython3-baselinux enterprise software development kit 12 sp43.4.10-25.39.2fixed
Susepython3linux enterprise software development kit 12 sp53.4.10-25.39.3fixed
Susepython3-baselinux enterprise software development kit 12 sp53.4.10-25.39.2fixed
Susepython3linux enterprise server 12 sp1-ltss3.4.10-25.39.3fixed
Susepython3-baselinux enterprise server 12 sp1-ltss3.4.10-25.39.2fixed
Susepython3linux enterprise server 12 sp2-ltss3.4.10-25.39.3fixed
Susepython3-baselinux enterprise server 12 sp2-ltss3.4.10-25.39.2fixed
Susepython3linux enterprise server 12 sp2-bcl3.4.10-25.39.3fixed
Susepython3-baselinux enterprise server 12 sp2-bcl3.4.10-25.39.2fixed
Susepython3linux enterprise server 12 sp3-ltss3.4.10-25.39.3fixed
Susepython3-baselinux enterprise server 12 sp3-ltss3.4.10-25.39.2fixed
Susepython3linux enterprise server 12 sp3-bcl3.4.10-25.39.3fixed
Susepython3-baselinux enterprise server 12 sp3-bcl3.4.10-25.39.2fixed
Susepython3linux enterprise server 12 sp43.4.10-25.39.3fixed
Susepython3-baselinux enterprise server 12 sp43.4.10-25.39.2fixed
Susepython3linux enterprise server for sap applications 12 sp43.4.10-25.39.3fixed
Susepython3-baselinux enterprise server for sap applications 12 sp43.4.10-25.39.2fixed
Susepython3linux enterprise server 12 sp53.4.10-25.39.3fixed
Susepython3-baselinux enterprise server 12 sp53.4.10-25.39.2fixed
Susepython3linux enterprise server for sap applications 12 sp53.4.10-25.39.3fixed
Susepython3-baselinux enterprise server for sap applications 12 sp53.4.10-25.39.2fixed
Susepython3enterprise storage 53.4.10-25.39.3fixed
Susepython3-baseenterprise storage 53.4.10-25.39.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianexpatsourcesid2.1.0~beta3-1not yet assignedNot reported[663579]
Debianexpatsourceforky2.1.0~beta3-1not yet assignedNot reported[663579]
Debianexpatsourcetrixie2.1.0~beta3-1not yet assignedNot reported[663579]
Debianexpatsourcebookworm2.1.0~beta3-1not yet assignedNot reported[663579]
Debianxmlrpc-csourcesid1.16.33-3.2lowNot reported[687672]
Debianxmlrpc-csourceforky1.16.33-3.2lowNot reported[687672]
Debianxmlrpc-csourcetrixie1.16.33-3.2lowNot reported[687672]
Debianxmlrpc-csourcebookworm1.16.33-3.2lowNot reported[687672]
Debianlibxmltoksourcebookworm(unfixed)not yet assignedNot reportedNot reported
Susepython3rpmhpe helion openstack 83.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmhpe helion openstack 83.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmopenstack cloud 73.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmopenstack cloud 73.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmopenstack cloud 83.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmopenstack cloud 83.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmopenstack cloud crowbar 83.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmopenstack cloud crowbar 83.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise desktop 12 sp43.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise desktop 12 sp43.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise module for web and scripting 123.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise module for web and scripting 123.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise server for sap applications 12 sp13.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise server for sap applications 12 sp13.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise server for sap applications 12 sp23.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise server for sap applications 12 sp23.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise server for sap applications 12 sp33.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise server for sap applications 12 sp33.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise software development kit 12 sp43.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise software development kit 12 sp43.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise software development kit 12 sp53.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise software development kit 12 sp53.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise server 12 sp1-ltss3.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp1-ltss3.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise server 12 sp2-ltss3.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp2-ltss3.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise server 12 sp2-bcl3.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp2-bcl3.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise server 12 sp3-ltss3.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp3-ltss3.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise server 12 sp3-bcl3.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp3-bcl3.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise server 12 sp43.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp43.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise server for sap applications 12 sp43.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise server for sap applications 12 sp43.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise server 12 sp53.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp53.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmlinux enterprise server for sap applications 12 sp53.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmlinux enterprise server for sap applications 12 sp53.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3rpmenterprise storage 53.4.10-25.39.3Not reportedSUSE-SU-2020:0497-1Not reported
Susepython3-baserpmenterprise storage 53.4.10-25.39.2Not reportedSUSE-SU-2020:0497-1Not reported

[Debian bug #663579][Debian bug #687672]

Notes

[bookworm] libxmltok: Minor issue, no runtime dependencies left

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [expat]Unknown
    Details (4)
    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

  • [libexpat1]Unknown

    Source package: [expat]

    Details (4)
    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

  • [libexpat1-dev]Unknown

    Source package: [expat]

    Details (4)
    • 2.5.0-1+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

    • 2.5.0-1+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · bookworm; dsa · expat · debian · 12

  • Source package: [xmlrpc-c]

    Details (2)
    • 1.33.14-11 · amd64 · bookworm

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · bookworm; dsa · xmlrpc-c · debian · 12

    • 1.33.14-11 · arm64 · bookworm

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · bookworm; dsa · xmlrpc-c · debian · 12

  • Source package: [xmlrpc-c]

    Details (2)
    • 1.33.14-11 · amd64 · bookworm

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · bookworm; dsa · xmlrpc-c · debian · 12

    • 1.33.14-11 · arm64 · bookworm

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · bookworm; dsa · xmlrpc-c · debian · 12

  • Source package: [xmlrpc-c]

    Details (2)
    • 1.33.14-11 · amd64 · bookworm

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · bookworm; dsa · xmlrpc-c · debian · 12

    • 1.33.14-11 · arm64 · bookworm

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · bookworm; dsa · xmlrpc-c · debian · 12

  • Source package: [xmlrpc-c]

    Details (2)
    • 1.33.14-11 · amd64 · bookworm

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · bookworm; dsa · xmlrpc-c · debian · 12

    • 1.33.14-11 · arm64 · bookworm

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · bookworm; dsa · xmlrpc-c · debian · 12

  • [libxmltok1]Unknown

    Source package: [libxmltok]

    Details (2)
    • 1.2-4 · amd64 · bookworm

      Affected

      dsa · libxmltok · debian · bookworm; dsa · libxmltok · debian · 12

    • 1.2-4 · arm64 · bookworm

      Affected

      dsa · libxmltok · debian · bookworm; dsa · libxmltok · debian · 12

  • Source package: [libxmltok]

    Details (2)
    • 1.2-4 · amd64 · bookworm

      Affected

      dsa · libxmltok · debian · bookworm; dsa · libxmltok · debian · 12

    • 1.2-4 · arm64 · bookworm

      Affected

      dsa · libxmltok · debian · bookworm; dsa · libxmltok · debian · 12

  • Source package: [xmlrpc-c]

    Details (2)
    • 1.33.14-11 · amd64 · bookworm

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · bookworm; dsa · xmlrpc-c · debian · 12

    • 1.33.14-11 · arm64 · bookworm

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · bookworm; dsa · xmlrpc-c · debian · 12

[Debian 13 (Trixie)]

  • [expat]Unknown
    Details (6)
    • 2.7.1-2 · amd64 · trixie

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.7.1-2 · arm64 · trixie

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.8.2-1~deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.9.0-1~deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

  • [libexpat1]Unknown

    Source package: [expat]

    Details (6)
    • 2.7.1-2 · amd64 · trixie

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.7.1-2 · arm64 · trixie

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.8.2-1~deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.9.0-1~deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

  • [libexpat1-dev]Unknown

    Source package: [expat]

    Details (6)
    • 2.7.1-2 · amd64 · trixie

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.7.1-2 · arm64 · trixie

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.8.2-1~deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.8.3-1~deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

    • 2.9.0-1~deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.1.0~beta3-1

      dsa · expat · debian · 13

  • Source package: [xmlrpc-c]

    Details (2)
    • 1.59.03-10 · amd64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

    • 1.59.03-10 · arm64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

  • Source package: [xmlrpc-c]

    Details (2)
    • 1.59.03-10 · amd64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

    • 1.59.03-10 · arm64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

  • Source package: [xmlrpc-c]

    Details (2)
    • 1.59.03-10 · amd64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

    • 1.59.03-10 · arm64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

  • Source package: [xmlrpc-c]

    Details (2)
    • 1.59.03-10 · amd64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

    • 1.59.03-10 · arm64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

  • Source package: [xmlrpc-c]

    Details (2)
    • 1.59.03-10 · amd64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

    • 1.59.03-10 · arm64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

  • Source package: [xmlrpc-c]

    Details (2)
    • 1.59.03-10 · amd64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

    • 1.59.03-10 · arm64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

  • Source package: [xmlrpc-c]

    Details (2)
    • 1.59.03-10 · amd64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

    • 1.59.03-10 · arm64 · trixie

      Fixed · Fixed: 1.16.33-3.2

      dsa · xmlrpc-c · debian · 13

Observed:

References