CVE-2012-0880: High severity apache xerces-c++ vulnerability
Apache Xerces-C++ allows remote attackers to cause a denial of service (CPU consumption) via a crafted message sent to an XML service that causes hash table collisions.
Other sources
Juraj Somorovsky reported that certain XML parsers/servers are affected by the same, or similar, flaw as the hash table collisions CPU usage denial of service. Sending a specially crafted message to an XML service can result in longer processing time, which could lead to a denial of service. It is reported that this attack on XML can be applied on different XML nodes (such as entities, element attributes, namespaces, various elements in the XML security, etc.).
xerces-c is written in C++ and makes significant use of arrays.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0880?
CVE-2012-0880 is classified as a medium severity vulnerability due to its potential for denial of service through excessive CPU consumption.
How do I fix CVE-2012-0880?
To fix CVE-2012-0880, update Apache Xerces-C++ to the latest version that addresses this vulnerability.
What type of attack does CVE-2012-0880 involve?
CVE-2012-0880 involves a denial of service attack through crafted XML messages that cause hash table collisions.
Which version of Apache is affected by CVE-2012-0880?
CVE-2012-0880 affects all versions of Apache Xerces-C++ prior to the version that includes the patch for this vulnerability.
Is CVE-2012-0880 easily exploitable?
CVE-2012-0880 can be exploited remotely, making it a significant threat if adequate protections are not in place.