{"id":"CVE-2012-1148","aliases":["DEBIAN-CVE-2012-1148","DSA-2525-1","EUVD-2012-1182","GHSA-hm5h-j86h-82pc","RHSA-2012:0731","UBUNTU-CVE-2012-1148","USN-5455-1","USN-7307-1","openSUSE-SU-2024:10077-1"],"status":"published","title":"Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context...","description":"Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0343,"percentile":0.8902,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2012-07-03T00:00:00Z","modified":"2026-10-23T17:47:25Z","fixes":[{"ecosystem":"Debian:12","package":"expat","fixed_in":["2.1.0~beta3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.1.0~beta3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.1.0~beta3-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xmlrpc-c","fixed_in":["1.16.33-3.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xmlrpc-c","fixed_in":["1.16.33-3.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xmlrpc-c","fixed_in":["1.16.33-3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxmltok","fixed_in":["1.2-3ubuntu0.16.04.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxmltok","fixed_in":["1.2-4ubuntu0.18.04.1~esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxmltok","fixed_in":["1.2-4ubuntu0.20.04.1~esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libxmltok","fixed_in":["1.2-4ubuntu0.22.04.1~esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libxmltok","fixed_in":["1.2-4.1ubuntu2.24.0.4.1+esm3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0~beta3-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4.1","1.2-4.1~exp1","1.2-4.2"]},{"source":"osv","ecosystem":"Debian:12","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.33-3.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.33-3.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.33-3.2"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-7+squeeze1"}]}],"versions":["2.0.1-7"],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.95.8-11.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.95.8-11.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.95.8-11.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.95.8-11.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.95.8-11.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.95.8-11.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.95.8-11.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.95.8-11.el5_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-11.el6_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-11.el6_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-11.el6_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-11.el6_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-11.el6_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-11.el6_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-11.el6_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-11.el6_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-11.el6_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-11.el6_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-11.el6_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.1-11.el6_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50-3","3.1.4~abc9f50-4","3.1.4~abc9f50-4ubuntu2","3.1.4~abc9f50-4ubuntu2+esm1","3.1.4~abc9f50-4ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37ubuntu5","4.1.1+xorg4.3.0-37ubuntu5.0.1","4.1.1+xorg4.3.0-37ubuntu5.0.2","4.1.1+xorg4.3.0-37ubuntu5.0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-3ubuntu0.16.04.1~esm2"}]}],"versions":["1.2-3build3","1.2-3ubuntu0.16.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ayttm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.3-3build1","0.6.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cableswig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0+git20150808-1","0.1.0+git20150808-2","0.1.0+git20150808-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"insighttoolkit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.20.1+git20120521-6","3.20.1+git20120521-6build1","3.20.1+git20120521-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-4","2.4.7-4build1","2.4.7-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2","4.1.1+xorg4.3.0-37.3ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-2","3.1.4~abc9f50+dfsg2-1","3.1.4~abc9f50+dfsg3-1","3.1.4~abc9f50+dfsg3-2","3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.18.04.1~esm5"}]}],"versions":["1.2-4","1.2-4ubuntu0.18.04.1~esm1","1.2-4ubuntu0.18.04.1~esm2","1.2-4ubuntu0.18.04.1~esm3","1.2-4ubuntu0.18.04.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5build1","0.13+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-5ubuntu1","2.4.7-5ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vnc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+xorg4.3.0-37.3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.20.04.1~esm5"}]}],"versions":["1.2-4","1.2-4ubuntu0.20.04.1~esm1","1.2-4ubuntu0.20.04.1~esm2","1.2-4ubuntu0.20.04.1~esm3","1.2-4ubuntu0.20.04.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-6","0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build1","2.4.7-6build2","2.4.7-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.22.04.1~esm5"}]}],"versions":["1.2-4","1.2-4ubuntu0.22.04.1~esm1","1.2-4ubuntu0.22.04.1~esm2","1.2-4ubuntu0.22.04.1~esm3","1.2-4ubuntu0.22.04.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build3","2.4.7-6.1","2.4.7-6.1build1","2.4.7-6.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24+dfsg-2","0.24+dfsg-3","0.24+dfsg-3build1","0.24+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1","0.13+ds2-1build1","0.13+ds2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4.1ubuntu2.24.0.4.1+esm3"}]}],"versions":["1.2-4ubuntu1","1.2-4.1ubuntu1","1.2-4.1ubuntu2","1.2-4.1ubuntu2.24.0.4.1+esm1","1.2-4.1ubuntu2.24.0.4.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.2","2.4.7-6.2build1","2.4.7-6.2build2","2.4.7-6.2build3","2.4.7-6.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"paraview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.2+dfsg-2ubuntu1","5.13.2+dfsg-2ubuntu2","5.13.2+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"sitecopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.16.6-16","1:0.16.6-16build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.3","2.4.7-6.3build1","2.4.7-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"paraview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.1+dfsg1-7","6.0.1+dfsg1-8","6.1.1+dfsg1-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"sitecopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.16.6-16build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7.1","2.4.7-7.2","2.4.7-7.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2","0.28+dfsg-1","0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2","0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"paraview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.2+dfsg-3","5.13.2+dfsg-3ubuntu1","5.13.2+dfsg-3.1","6.0.1+dfsg1-6ubuntu1","6.0.1+dfsg1-7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"sitecopy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:0.16.6-16build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7","2.4.7-7.1","2.4.7-7.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-3ubuntu0.16.04.1~esm2"}]}],"versions":["1.2-3build3","1.2-3ubuntu0.16.04.1~esm1"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.18.04.1~esm1"}]}],"versions":["1.2-4"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.20.04.1~esm1"}]}],"versions":["1.2-4"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.22.04.1~esm1"}]}],"versions":["1.2-4"],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.18.04.1~esm5"}]}],"versions":["1.2-4","1.2-4ubuntu0.18.04.1~esm1","1.2-4ubuntu0.18.04.1~esm2","1.2-4ubuntu0.18.04.1~esm3","1.2-4ubuntu0.18.04.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.20.04.1~esm5"}]}],"versions":["1.2-4","1.2-4ubuntu0.20.04.1~esm1","1.2-4ubuntu0.20.04.1~esm2","1.2-4ubuntu0.20.04.1~esm3","1.2-4ubuntu0.20.04.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4ubuntu0.22.04.1~esm5"}]}],"versions":["1.2-4","1.2-4ubuntu0.22.04.1~esm1","1.2-4ubuntu0.22.04.1~esm2","1.2-4ubuntu0.22.04.1~esm3","1.2-4ubuntu0.22.04.1~esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2-4.1ubuntu2.24.0.4.1+esm3"}]}],"versions":["1.2-4ubuntu1","1.2-4.1ubuntu1","1.2-4.1ubuntu2","1.2-4.1ubuntu2.24.0.4.1+esm1","1.2-4.1ubuntu2.24.0.4.1+esm2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-3.1"}]}],"bundled":11}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"libexpat_project","product":"libexpat"}],"references":[{"url":"http://secunia.com/advisories/49504","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1527-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://support.apple.com/HT205637","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1034344","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.166\u0026r2=1.167","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://secunia.com/advisories/51040","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0731.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/52379","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://sourceforge.net/projects/expat/files/expat/2.1.0/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0062.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://www.debian.org/security/2012/dsa-2525","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2012:041","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://sourceforge.net/tracker/?func=detail\u0026atid=110127\u0026aid=2958794\u0026group_id=10127","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2957.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1613-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/51024","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1613-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-1148","tags":["advisory"]},{"url":"http://sourceforge.net/projects/expat/files/expat/2.1.0"},{"url":"https://github.com/advisories/GHSA-hm5h-j86h-82pc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-1148","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2012:0731","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=786617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=801648","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0731.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-0876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-0876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0876","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-1148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-1148","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2012-1148","tags":["report"]},{"url":"http://mail.python.org/pipermail/expat-bugs/2010-February/002870.html","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2012/03/09/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-1527-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-1527-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-1613-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-1613-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5455-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7307-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-1283","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-0718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20843","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15903","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-46143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22822","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22823","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22824","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22825","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22826","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-22827","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-25235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-25236","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5300","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-1148","description":"Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.","status":"published","published":"2012-07-03T19:00:00Z","modified":"2024-08-06T18:45:27.498Z","updated_at":"2026-11-02T14:34:52.27879Z"}],"euvd":[{"id":"EUVD-2012-1182","description":"Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.","status":"published","published":"2012-07-03T19:00:00Z","modified":"2024-08-06T18:45:27Z","updated_at":"2026-11-03T01:56:18.872973Z"}],"ghsa":[{"id":"GHSA-hm5h-j86h-82pc","title":"Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context...","description":"Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.","status":"published","published":"2022-05-13T01:12:02Z","modified":"2025-04-11T04:00:05Z","updated_at":"2026-11-02T15:01:11.088321Z"}],"nvd":[{"id":"CVE-2012-1148","description":"Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.","status":"published","published":"2012-07-03T19:55:02.757Z","modified":"2026-06-16T23:39:07.9Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:14.774945Z"}],"osv":[{"id":"RHSA-2012:0731","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2024-09-15T19:53:36Z","modified":"2026-09-21T10:01:13Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"CVE-2012-1148","description":"Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.","status":"published","published":"2012-07-03T19:55:02Z","modified":"2026-04-10T03:42:15.025831Z","updated_at":"2026-11-02T15:43:58.537032Z"},{"id":"DEBIAN-CVE-2012-1148","description":"Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.","status":"published","published":"2012-07-03T19:55:02.757Z","modified":"2026-10-23T17:47:25.491007394Z","updated_at":"2026-11-02T15:45:24.92418Z"},{"id":"DSA-2525-1","title":"expat - several","status":"published","published":"2012-08-06T00:00:00Z","modified":"2026-03-09T01:23:03.692722Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"openSUSE-SU-2024:10077-1","title":"expat-2.2.0-3.1 on GA media","description":"These are all security issues fixed in the expat-2.2.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:38:59.05966Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2012-1148","description":"Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.","status":"published","published":"2012-07-03T00:00:00Z","modified":"2026-10-17T12:52:47.044312955Z","updated_at":"2026-11-02T15:54:06.395274Z"},{"id":"USN-5455-1","title":"libxmltok vulnerabilities","description":"Tim Boddy, Gustavo Grieco and others discovered that Expat, that is\nintegrated in xmltok library, incorrectly handled certain files.\nAn attacker could possibly use these issues to cause a denial of\nservice, or possibly execute arbitrary code. These issues were only\naddressed in Ubuntu 16.04 ESM. (CVE-2012-1148, CVE-2015-1283,\nCVE-2016-0718, CVE-2016-4472, CVE-2018-20843, CVE-2019-15903,\nCVE-2021-46143, CVE-2022-22822, CVE-2022-22823, CVE-2022-22824,\nCVE-2022-22825, CVE-2022-22826, CVE-2022-22827)\n\nIt was discovered that Expat, that is integrated in xmltok library,\nincorrectly handled encoding validation of certain files. An attacker\ncould possibly use this issue to cause a denial of service, or\npossibly execute arbitrary code. (CVE-2022-25235)\n\nIt was discovered that Expat, that is integrated in xmltok library,\nincorrectly handled namespace URIs of certain files. An attacker\ncould possibly use this issue to cause a denial of service, or\npossibly execute arbitrary code. (CVE-2022-25236)\n\n","status":"published","published":"2022-07-19T17:11:00Z","modified":"2026-06-25T13:31:12.880446076Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-7307-1","title":"libxmltok vulnerability","description":"Tim Boddy discovered that Expat, contained within the xmltok library, did\nnot properly handle memory reallocation when processing XML files. If a\nuser or application linked against Expat were tricked into opening a\ncrafted XML file, an attacker could cause a denial of service by consuming\nexcessive memory resources.\n","status":"published","published":"2025-02-26T22:33:09Z","modified":"2026-04-27T17:46:13.117909Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}