PT-2012-4778 · Ocaml · Xml-Light Library

Kurt Seifried · Publicado 2012-08-25 · Atualizado 2014-02-12 · CVE-2012-3514

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OCaml Xml-Light Library versions prior to r234

Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, by triggering hash collisions predictably. This is due to the library's computation of hash values without proper restrictions.

Recommendations For versions prior to r234, update to version r234 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-3514

Produtos afetados

Xml-Light Library

Referências · 12

• http://secunia.com/advisories/50311 · Aviso do Fabricante
• http://securityfocus.com/bid/55114 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3514 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/08/21/2 · Nota
• https://cve.org/CVERecord?id=CVE-2012-3514 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2012-3514 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-3514 · Aviso do Fabricante
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0266 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2013:107 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-3514 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2012-3514 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-3514 · Nota de Segurança