Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 519500 (CVE-2012-0880) - dev-libs/xerces-c: hash table collisions CPU usage DoS (oCERT-2011-003)
Summary: dev-libs/xerces-c: hash table collisions CPU usage DoS (oCERT-2011-003)
Status: RESOLVED WONTFIX
Alias: CVE-2012-0880
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [upstream]
Keywords:
Depends on:
Blocks: hashDoS
  Show dependency tree
 
Reported: 2014-08-09 12:20 UTC by Agostino Sarubbo
Modified: 2016-03-19 08:24 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2014-08-09 12:20:03 UTC
From ${URL} :

Juraj Somorovsky reported that certain XML parsers/servers are affected by the
same, or similar, flaw as the hash table collisions CPU usage denial of
service.  Sending a specially crafted message to an XML service can result in
longer processing time, which could lead to a denial of service.  It is
reported that this attack on XML can be applied on different XML nodes (such as
entities, element attributes, namespaces, various elements in the XML security,
etc.).

xerces-c is written in C++ and makes significant use of arrays.


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2016-03-19 08:24:50 UTC
No traceable information for this vulnerability.  No other distro has anything either regarding the matter either.