CVE-2012-0881
High · 7.5CVSS
7.5
EPSS
17.5%
Published
Oct 30, 2017
CISA due date
—
The record
Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | xerces:xercesImpl | 0 | 2.12.0 |
| Debian:10 | libxerces2-java | 0 | No fix |
| Debian:11 | libxerces2-java | 0 | No fix |
| Debian:12 | libxerces2-java | 0 | No fix |
| Debian:13 | libxerces2-java | 0 | No fix |
| Ubuntu:14.04:LTS | libxerces2-java | 0 | No fix |
| Ubuntu:16.04:LTS | libxerces2-java | 0 | No fix |
| Ubuntu:18.04:LTS | libxerces2-java | 0 | No fix |
| Ubuntu:20.04:LTS | libxerces2-java | 0 | No fix |
| Ubuntu:22.04:LTS | libxerces2-java | 0 | No fix |
| Ubuntu:24.04:LTS | libxerces2-java | 0 | No fix |
| Ubuntu:24.10 | libxerces2-java | 0 | No fix |
| Ubuntu:25.04 | libxerces2-java | 0 | No fix |
| Ubuntu:25.10 | libxerces2-java | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | libxerces2-java | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | libxerces2-java | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | libxerces2-java | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | libxerces2-java | 0 | No fix |
Related vulnerabilities
- CVE-2022-23437 There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling… Also affects xerces:xercesImpl
- CVE-2013-4002 XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime… Also affects xerces:xercesImpl
- CVE-2009-2625 XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in… Also affects xerces:xercesImpl
- CVE-2026-41983 Null pointer dereference vulnerability in the browser module. Impact: Successful… CWE-399
- CVE-2015-9252 An issue was discovered in QPDF before 7.0.0. CWE-399
- CVE-2015-7944 The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x… CWE-399
- CVE-2015-8855 The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service… CWE-399
- CVE-2015-8858 The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of… CWE-399