Unscored severity · published Jul 3, 2012
CVE-2012-1148
Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large…
–
CVSS
3.5%
EPSS
No
On KEV
Description
Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libexpat · Libexpat Project
through 2.0.1; 1.95.1; 1.95.2; 1.95.4; 1.95.5; 1.95.6; +3 more · source: NVD
MO
Mac OS X · Apple
through 10.11.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1148
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1148
Patch
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.166&r2=1.167
lists.apple.com
http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-0731.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2016-0062.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2016-2957.html
Vendor Advisory
http://secunia.com/advisories/49504
More from Mac OS X
9.8
CVE-2021-1871
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
9.8
CVE-2021-1870
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability
8.8
CVE-2022-2294
WebRTC Heap Buffer Overflow Vulnerability
8.8
CVE-2021-1789
Apple Multiple Products Type Confusion Vulnerability