CVE-2012-1147: Input Validation
First published: Tue Jul 03 2012(Updated: )
readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor consumption) via a large number of crafted XML files.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple iOS and macOS | =10.11.0 | |
| Apple iOS and macOS | =10.11.1 | |
| Debian (libexpat1) | <=2.0.1 | |
| Debian (libexpat1) | =1.95.1 | |
| Debian (libexpat1) | =1.95.2 | |
| Debian (libexpat1) | =1.95.4 | |
| Debian (libexpat1) | =1.95.5 | |
| Debian (libexpat1) | =1.95.6 | |
| Debian (libexpat1) | =1.95.7 | |
| Debian (libexpat1) | =1.95.8 | |
| Debian (libexpat1) | =2.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://expat.cvs.sourceforge.net/viewvc/expat/expat/xmlwf/readfilemap.c?r1=1.14&r2=1.15
- http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html
- http://sourceforge.net/projects/expat/files/expat/2.1.0/
- http://sourceforge.net/tracker/?func=detail&aid=2895533&group_id=10127&atid=110127
- http://trac.wxwidgets.org/ticket/11194
- http://trac.wxwidgets.org/ticket/11432
- http://www.securityfocus.com/bid/52379
- http://www.securitytracker.com/id/1034344
- https://support.apple.com/HT205637
Frequently Asked Questions
What is the severity of CVE-2012-1147?
CVE-2012-1147 is classified as a denial of service vulnerability.
How do I fix CVE-2012-1147?
The recommended fix for CVE-2012-1147 is to upgrade to libexpat version 2.1.0 or later.
Which versions of libexpat are affected by CVE-2012-1147?
CVE-2012-1147 affects libexpat versions prior to 2.1.0.
What impact does CVE-2012-1147 have on affected systems?
CVE-2012-1147 can lead to file descriptor consumption, potentially causing denial of service.
Is macOS Yosemite vulnerable to CVE-2012-1147?
Yes, macOS Yosemite versions 10.11.0 and 10.11.1 are vulnerable to CVE-2012-1147.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apple
- canonical/apple ios and macos
- version/apple ios and macos/10.11.0
- version/apple ios and macos/10.11.1
- vendor/libexpat project
- canonical/debian (libexpat1)
- version/debian (libexpat1)/2.0.1
- version/debian (libexpat1)/1.95.1
- version/debian (libexpat1)/1.95.2
- version/debian (libexpat1)/1.95.4
- version/debian (libexpat1)/1.95.5
- version/debian (libexpat1)/1.95.6
- version/debian (libexpat1)/1.95.7
- version/debian (libexpat1)/1.95.8
- version/debian (libexpat1)/2.0.0