Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 519502 (CVE-2012-0881) - dev-java/xerces: hash table collisions CPU usage DoS (CVE-2012-0881)
Summary: dev-java/xerces: hash table collisions CPU usage DoS (CVE-2012-0881)
Alias: CVE-2012-0881
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
Whiteboard: B3 [noglsa]
Depends on: 268619
Blocks: hashDoS
  Show dependency tree
Reported: 2014-08-09 12:21 UTC by Agostino Sarubbo
Modified: 2015-12-23 23:46 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-08-09 12:21:56 UTC
From ${URL} :

Juraj Somorovsky reported that certain XML parsers/servers are affected by the
same, or similar, flaw as the hash table collisions CPU usage denial of
service.  Sending a specially crafted message to an XML service can result in
longer processing time, which could lead to a denial of service.  It is
reported that this attack on XML can be applied on different XML nodes (such as
entities, element attributes, namespaces, various elements in the XML security,

xerces-j2 is written in Java and makes significant use of arrays.

@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Patrice Clement gentoo-dev 2015-11-01 18:38:50 UTC
This CVE is not really explanatory: which version is affected? what is the fix? We ship xerces-1.3 and the very latest version available at, that is 2.11.0. I guess it might affect older versions. The only package relying on xerces-1.3 is castor and it's been marked for removal. I will remove it after castor is removed. Please note that RH closed the bug as WONTFIX:
Comment 2 Patrice Clement gentoo-dev 2015-12-02 16:27:13 UTC
* commit 95e1895
| Author: Patrice Clement <>
| Date:   Wed Dec 2 16:19:49 2015 +0000
|     dev-java/xerces: Remove vulnerable version. Fixes security bug 519502.
|     Package-Manager: portage-
|     Signed-off-by: Patrice Clement <>
|  delete mode 100644 dev-java/xerces/files/xerces-1.3.1-build.xml
|  delete mode 100644 dev-java/xerces/files/xerces-2.3.0-gentoo.patch
|  delete mode 100644 dev-java/xerces/files/xerces-2.9.0-gentoo.patch
|  delete mode 100644 dev-java/xerces/files/xerces-2.9.0-no_dom3.patch
|  delete mode 100644 dev-java/xerces/files/xerces-2.9.1-gentoo.patch
|  delete mode 100644 dev-java/xerces/files/xerces-2.9.1-no_dom3.patch
|  delete mode 100644 dev-java/xerces/xerces-1.3.1-r2.ebuild

Security team,

Please vote.
Comment 3 Yury German Gentoo Infrastructure gentoo-dev 2015-12-02 16:57:30 UTC
Please review for the future. Vote is not one of the whiteboards :)

Security Please Vote.
GLSA Vote: No
Comment 4 Yury German Gentoo Infrastructure gentoo-dev 2015-12-23 23:46:23 UTC
Thank you all. Closing as noglsa.