CVE-2012-0881: High severity Apache Xerces2 Java vulnerability
Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
Other sources
Juraj Somorovsky reported that certain XML parsers/servers are affected by the same, or similar, flaw as the hash table collisions CPU usage denial of service. Sending a specially crafted message to an XML service can result in longer processing time, which could lead to a denial of service. It is reported that this attack on XML can be applied on different XML nodes (such as entities, element attributes, namespaces, various elements in the XML security, etc.).
xerces-j2 is written in Java and makes significant use of arrays.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this Apache Xerces2 Java vulnerability?
The vulnerability ID for this Apache Xerces2 Java vulnerability is CVE-2012-0881.
What is the severity of CVE-2012-0881?
The severity of CVE-2012-0881 is high with a severity value of 7.5.
How does the vulnerability in Apache Xerces2 Java occur?
The vulnerability in Apache Xerces2 Java occurs due to a flaw in the XML service, which can be exploited by sending a specially crafted message to an XML service.
What is the affected software for CVE-2012-0881?
The affected software for CVE-2012-0881 is IBM Security Verify Governance version up to and including 10.0.
How can the Apache Xerces2 Java vulnerability be fixed?
To fix the Apache Xerces2 Java vulnerability, it is recommended to apply the latest security patches and updates provided by the vendor.