CVE-2012-3514 OCaml Xml-Light Library before r234 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (...
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OCaml Xml-Light Library before r234 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xml-light(Debian:12) | < 2.2-15 | 2.2-15 |
| debian/xml-light(Debian:13) | < 2.2-15 | 2.2-15 |
| debian/xml-light(Debian:14) | < 2.2-15 | 2.2-15 |
| nicolas cannasse ocaml xml-light library | <= r233 | No fix listed |
References
- Debian Security Tracker CVE-2012-3514 vendor-advisory
- 50311 third-party-advisory vendor-advisory
- MDVSA-2013:107 vendor-advisory
- [oss-security] 20120820 ocaml-xml-light: hash table collisions CPU usage DoS CVE-2012-3514 mailing-list
- 55114 vdb-entry
- wiki.mageia.org
- bugs.debian.org issue-tracking