CVE-2012-1148
Fixed in a distro release EPSS 3%
Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.
Products: libexpat_project libexpat, apple mac_os_x
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | expat | 2.1.0~beta3-1 |
| Debian 12 | libxmltok | no fix |
| Debian 12 | xmlrpc-c | 1.16.33-3.2 |
| Debian 13 | expat | 2.1.0~beta3-1 |
| Debian 13 | xmlrpc-c | 1.16.33-3.2 |
| Debian 14 | expat | 2.1.0~beta3-1 |
| Debian 14 | xmlrpc-c | 1.16.33-3.2 |
| Debian 6.0 | expat | 2.0.1-7+squeeze1 |
| Red Hat Enterprise Linux 5 | expat | 0:1.95.8-11.el5_8 |
| Red Hat Enterprise Linux 5 | expat-debuginfo | 0:1.95.8-11.el5_8 |
| Red Hat Enterprise Linux 5 | expat-devel | 0:1.95.8-11.el5_8 |
| Red Hat Enterprise Linux 6 | expat | 0:2.0.1-11.el6_2 |
| Red Hat Enterprise Linux 6 | expat-debuginfo | 0:2.0.1-11.el6_2 |
| Red Hat Enterprise Linux 6 | expat-devel | 0:2.0.1-11.el6_2 |
| Ubuntu 16.04 LTS | cadaver | no fix |
| Ubuntu 16.04 LTS | matanza | no fix |
| Ubuntu 18.04 LTS | cadaver | no fix |
| Ubuntu 18.04 LTS | matanza | no fix |
| Ubuntu 18.04 LTS | vnc4 | no fix |
| Ubuntu 20.04 LTS | cadaver | no fix |
| Ubuntu 20.04 LTS | matanza | no fix |
| Ubuntu 22.04 LTS | cadaver | no fix |
| Ubuntu 22.04 LTS | matanza | no fix |
| Ubuntu 24.04 LTS | cadaver | no fix |
| Ubuntu 24.04 LTS | matanza | no fix |
| Ubuntu 25.10 | cadaver | no fix |
| Ubuntu 25.10 | matanza | no fix |
| Ubuntu 25.10 | paraview | no fix |
| Ubuntu 25.10 | sitecopy | no fix |
| Ubuntu 25.10 | swish-e | no fix |
| Ubuntu 26.04 LTS | cadaver | no fix |
| Ubuntu 26.04 LTS | matanza | no fix |
| Ubuntu 26.04 LTS | paraview | no fix |
| Ubuntu 26.04 LTS | sitecopy | no fix |
| Ubuntu 26.10 | cadaver | no fix |
| Ubuntu 26.10 | matanza | no fix |
| Ubuntu 26.10 | paraview | no fix |
| Ubuntu 26.10 | sitecopy | no fix |
| Ubuntu 26.10 | swish-e | no fix |
| Ubuntu Pro 14.04 LTS | coin3 | no fix |
| Ubuntu Pro 14.04 LTS | vnc4 | no fix |
| Ubuntu Pro 16.04 LTS | ayttm | no fix |
| Ubuntu Pro 16.04 LTS | cableswig | no fix |
| Ubuntu Pro 16.04 LTS | coin3 | no fix |
| Ubuntu Pro 16.04 LTS | insighttoolkit | no fix |
| Ubuntu Pro 16.04 LTS | libxmltok | 1.2-3ubuntu0.16.04.1~esm2 |
| Ubuntu Pro 16.04 LTS | swish-e | no fix |
| Ubuntu Pro 16.04 LTS | vnc4 | no fix |
| Ubuntu Pro 18.04 LTS | coin3 | no fix |
| Ubuntu Pro 18.04 LTS | libxmltok | 1.2-4ubuntu0.18.04.1~esm1 |
| Ubuntu Pro 18.04 LTS | libxmltok | 1.2-4ubuntu0.18.04.1~esm5 |
| Ubuntu Pro 18.04 LTS | swish-e | no fix |
| Ubuntu Pro 20.04 LTS | libxmltok | 1.2-4ubuntu0.20.04.1~esm1 |
| Ubuntu Pro 20.04 LTS | libxmltok | 1.2-4ubuntu0.20.04.1~esm5 |
| Ubuntu Pro 20.04 LTS | swish-e | no fix |
| Ubuntu Pro 22.04 LTS | libxmltok | 1.2-4ubuntu0.22.04.1~esm5 |
| Ubuntu Pro 22.04 LTS | libxmltok | 1.2-4ubuntu0.22.04.1~esm1 |
| Ubuntu Pro 22.04 LTS | swish-e | no fix |
| Ubuntu Pro 24.04 LTS | libxmltok | 1.2-4.1ubuntu2.24.0.4.1+esm3 |
| Ubuntu Pro 24.04 LTS | swish-e | no fix |
| Ubuntu Pro 26.04 LTS | swish-e | no fix |
| openSUSE Tumbleweed | expat | 2.2.0-3.1 |