PT-2012-4778 · Ocaml · Xml-Light Library

Kurt Seifried · Published 2012-08-25 · Updated 2014-02-12 · CVE-2012-3514

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OCaml Xml-Light Library versions prior to r234

Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, by triggering hash collisions predictably. This is due to the library's computation of hash values without proper restrictions.

Recommendations For versions prior to r234, update to version r234 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2012-3514

Affected Products

Xml-Light Library

References · 12

• http://secunia.com/advisories/50311 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3514 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-3514 · Security Note
• https://osv.dev/vulnerability/CVE-2012-3514 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-3514 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:107 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-3514 · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-3514 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3514 · Security Note
• http://securityfocus.com/bid/55114 · Note
• http://openwall.com/lists/oss-security/2012/08/21/2 · Note
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0266 · Note