PT-2012-1196 · Apache+1 · Apache Xerces2 Java Parser+1

Bradley Parker · Published 2012-02-03 · Updated 2023-02-13 · CVE-2012-0881

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Xerces2 Java Parser versions prior to 2.12.0

Description The issue is related to resource management errors in the XML file analyzer. It can be exploited by a remote attacker using a specially crafted XML message, leading to a denial of service due to CPU consumption. This is achieved by triggering hash table collisions in an XML service.

Recommendations For versions prior to 2.12.0, update to version 2.12.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the XML service to minimize the risk of exploitation. Avoid using the vulnerable parser until the issue is resolved.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-399

CWE-400

Related Identifiers

BDU:2018-00147

CVE-2012-0881

GHSA-VMQM-G3VH-847M

Affected Products

Apache Xerces2 Java Parser

Debian

References · 33

• https://security-tracker.debian.org/tracker/source-package/libxerces2-java · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-0881 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-0881 · Security Note
• https://issues.apache.org/jira/browse/XERCESJ-1685 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-0881 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00147 · Security Note
• https://osv.dev/vulnerability/CVE-2012-0881 · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-0881 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-0881 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0881 · Security Note
• https://osv.dev/vulnerability/GHSA-vmqm-g3vh-847m · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0881 · Vendor Advisory
• https://github.com/apache/xerces2-j/commit/992b5d9c24102ad20330d36c0a71162753a37449 · Note
• https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E · Note
• https://lists.apache.org/thread.html/rea7b831dceeb2a2fa817be6f63b08722042e3647fb2d47c144370a56%40%3Ccommon-issues.hadoop.apache.org%3E · Note