CVE-2012-6702
published 2016-06-16CVE-2012-6702: Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat…
medium5.9CVSS 3.0
AVNACHPRNUINSUCNIHAN
Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | itunes | — | — |
| apple | itunes_12.6_for_windows | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | expat | < expat 2.1.1-3 (bookworm) | expat 2.1.1-3 (bookworm) |
| debian | libxmltok | < expat 2.1.1-3 (bookworm) | expat 2.1.1-3 (bookworm) |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| libexpat_project | libexpat | < 2.2.0 | 2.2.0 |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
osv5.9MEDIUM
Apple
CVE-2012-6702: iTunes 12.6
vendor_apple·2017-03-21·CVSS 5.9
CVE-2012-6702 [MEDIUM] CVE-2012-6702: iTunes 12.6
Apple Security Update: About the security content of iTunes 12.6
Product: iTunes
Version: 12.6
CVE: CVE-2012-6702
Component: CVE-2012-6702
Apple
CVE-2012-6702: iTunes 12.6 for Windows
vendor_apple·2017-03-21·CVSS 5.9
CVE-2012-6702 [MEDIUM] CVE-2012-6702: iTunes 12.6 for Windows
Apple Security Update: About the security content of iTunes 12.6 for Windows
Product: iTunes 12.6 for Windows
CVE: CVE-2012-6702
Component: CVE-2012-6702
Android
CVE-2012-6702: Android Security Bulletin 2016-11-01
CVE: CVE-2012-6702
Severity: MEDIUM
Affected AOSP versions: 4
vendor_android·2016-11-01·CVSS 5.9
CVE-2012-6702 [MEDIUM] CVE-2012-6702: Android Security Bulletin 2016-11-01
CVE: CVE-2012-6702
Severity: MEDIUM
Affected AOSP versions: 4
Android Security Bulletin 2016-11-01
CVE: CVE-2012-6702
Severity: MEDIUM
Affected AOSP versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1
References: A-29149404
Ubuntu
Expat vulnerabilities
vendor_ubuntu·2016-06-20·CVSS 5.9
CVE-2012-6702 [MEDIUM] Expat vulnerabilities
Title: Expat vulnerabilities
Summary: Several security issues were fixed in Expat.
It was discovered that Expat unexpectedly called srand in certain
circumstances. This could reduce the security of calling applications.
(CVE-2012-6702)
It was discovered that Expat incorrectly handled seeding the random number
generator. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2016-5300)
Instructions: After a standard system upgrade you need to restart any applications linked
against Expat to effect the necessary changes.
Ubuntu
XML-RPC for C and C++ vulnerabilities
vendor_ubuntu·2016-06-20·CVSS 5.9
CVE-2012-6702 [MEDIUM] XML-RPC for C and C++ vulnerabilities
Title: XML-RPC for C and C++ vulnerabilities
Summary: Several security issues were fixed in XML-RPC for C and C++.
It was discovered that the Expat code in XML-RPC for C and C++ unexpectedly
called srand in certain circumstances. This could reduce the security of
calling applications. (CVE-2012-6702)
It was discovered that the Expat code in XML-RPC for C and C++ incorrectly
handled seeding the random number generator. A remote attacker could
possibly use this issue to cause a denial of service. (CVE-2016-5300)
Gustavo Grieco discovered that the Expat code in XML-RPC for C and C++
incorrectly handled malformed XML data. If a user or application linked
against XML-RPC for C and C++ were tricked into opening a crafted XML file,
an attacker could cause a denial of service, or possibly exec
Red Hat
expat: Using XML_Parse before rand() results into non-random output
vendor_redhat·2015-02-27·CVSS 5.9
CVE-2012-6702 [MEDIUM] CWE-330 expat: Using XML_Parse before rand() results into non-random output
expat: Using XML_Parse before rand() results into non-random output
Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.
Package: expat (Red Hat Directory Server 8) - Under investigation
Package: expat (Red Hat Enterprise Linux 5) - Will not fix
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 5) - Not affected
Package: xmlrpc-c (Red Hat Enterprise Linux 5) - Will not fix
Package: xulrunner (Red Hat Enterprise Linux 5) - Not affected
Package: compat-expat1 (Red Hat Enterprise Linux 6) - Not affected
Package: expat (Red Hat Enterprise Linux 6) -
Debian
CVE-2012-6702: expat - Expat, when used in a parser that has not called XML_SetHashSalt or passed it a ...
vendor_debian·2012·CVSS 5.9
CVE-2012-6702 [MEDIUM] CVE-2012-6702: expat - Expat, when used in a parser that has not called XML_SetHashSalt or passed it a ...
Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.
Scope: local
bookworm: resolved (fixed in 2.1.1-3)
bullseye: resolved (fixed in 2.1.1-3)
forky: resolved (fixed in 2.1.1-3)
sid: resolved (fixed in 2.1.1-3)
trixie: resolved (fixed in 2.1.1-3)
GHSA
GHSA-qfwq-qvmm-7j3x: Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat c
ghsa_unreviewed·2022-05-13
CVE-2012-6702 [MEDIUM] GHSA-qfwq-qvmm-7j3x: Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat c
Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.
OSV
expat vulnerabilities
osv·2016-06-20·CVSS 5.9
CVE-2012-6702 [MEDIUM] expat vulnerabilities
expat vulnerabilities
It was discovered that Expat unexpectedly called srand in certain
circumstances. This could reduce the security of calling applications.
(CVE-2012-6702)
It was discovered that Expat incorrectly handled seeding the random number
generator. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2016-5300)
OSV
CVE-2012-6702: Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat c
osv·2016-06-16·CVSS 5.9
CVE-2012-6702 [MEDIUM] CVE-2012-6702: Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat c
Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-6702 mingw-expat: expat: Using XML_Parse before rand() results into non-random output [fedora-all]
bugzilla·2016-03-21·CVSS 5.9
CVE-2012-6702 [MEDIUM] CVE-2012-6702 mingw-expat: expat: Using XML_Parse before rand() results into non-random output [fedora-all]
CVE-2012-6702 mingw-expat: expat: Using XML_Parse before rand() results into non-random output [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects m
Bugzilla
CVE-2012-6702 expat: Using XML_Parse before rand() results into non-random output
bugzilla·2016-03-21·CVSS 5.9
CVE-2012-6702 [MEDIUM] CVE-2012-6702 expat: Using XML_Parse before rand() results into non-random output
CVE-2012-6702 expat: Using XML_Parse before rand() results into non-random output
It was found that when calling XML_Parse ahead of rand(), it causes the pseudo random generator to generate non-random predictable numbers.
Product bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1197087
Discussion:
Created compat-expat1 tracking bugs for this issue:
Affects: fedora-all [bug 1319733]
---
Created expat tracking bugs for this issue:
Affects: fedora-all [bug 1319732]
---
Created mingw-expat tracking bugs for this issue:
Affects: fedora-all [bug 1319734]
Affects: epel-7 [bug 1319736]
---
Created expat21 tracking bugs for this issue:
Affects: epel-all [bug 1319735]
---
CVE assignment:
http://seclists.org/oss-sec/2016/q2/469
---
Created attachment 1165212
Proposed upstream patc
Bugzilla
CVE-2012-6702 expat21: expat: Using XML_Parse before rand() results into non-random output [epel-all]
bugzilla·2016-03-21·CVSS 5.9
CVE-2012-6702 [MEDIUM] CVE-2012-6702 expat21: expat: Using XML_Parse before rand() results into non-random output [epel-all]
CVE-2012-6702 expat21: expat: Using XML_Parse before rand() results into non-random output [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mu
Bugzilla
CVE-2012-6702 mingw-expat: expat: Using XML_Parse before rand() results into non-random output [epel-7]
bugzilla·2016-03-21·CVSS 5.9
CVE-2012-6702 [MEDIUM] CVE-2012-6702 mingw-expat: expat: Using XML_Parse before rand() results into non-random output [epel-7]
CVE-2012-6702 mingw-expat: expat: Using XML_Parse before rand() results into non-random output [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically create
Bugzilla
CVE-2012-6702 expat: Using XML_Parse before rand() results into non-random output [fedora-all]
bugzilla·2016-03-21·CVSS 5.9
CVE-2012-6702 [MEDIUM] CVE-2012-6702 expat: Using XML_Parse before rand() results into non-random output [fedora-all]
CVE-2012-6702 expat: Using XML_Parse before rand() results into non-random output [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple suppo
Bugzilla
CVE-2012-6702 compat-expat1: expat: Using XML_Parse before rand() results into non-random output [fedora-all]
bugzilla·2016-03-21·CVSS 5.9
CVE-2012-6702 [MEDIUM] CVE-2012-6702 compat-expat1: expat: Using XML_Parse before rand() results into non-random output [fedora-all]
CVE-2012-6702 compat-expat1: expat: Using XML_Parse before rand() results into non-random output [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
XML_Parse breaks rand() function
bugzilla·2015-02-27
XML_Parse breaks rand() function
XML_Parse breaks rand() function
Created attachment 996033
Suggested patch
Description of problem:
Calling XML_Parse seeds the rand() pseudo random generator, causing it to generate non-random and predictable numbers.
Version-Release number of selected component (if applicable):
expat-2.1.0-11.fc23
How reproducible:
Always
Steps to Reproduce:
1. cat expat_test.c
#include
#include
#include
int
main(void)
{
XML_Parser parser;
int i;
for(i = 0; i
#include
bool has_srand_been_called_before() {
if (rand() != 1804289383)
return true;
if (rand() != 846930886)
return true;
if (rand() != 1681692777)
return true;
return false;
}
void main() {
if (! has_srand_been_called_before()) {
printf("srand(1) detected, call to srand() needed.\n");
srand(17); /* except with more entropy */
}
printf("ra
http://www.debian.org/security/2016/dsa-3597http://www.openwall.com/lists/oss-security/2016/06/03/8http://www.openwall.com/lists/oss-security/2016/06/04/1http://www.securityfocus.com/bid/91483http://www.ubuntu.com/usn/USN-3010-1https://security.gentoo.org/glsa/201701-21https://source.android.com/security/bulletin/2016-11-01.htmlhttps://www.tenable.com/security/tns-2016-20http://www.debian.org/security/2016/dsa-3597http://www.openwall.com/lists/oss-security/2016/06/03/8http://www.openwall.com/lists/oss-security/2016/06/04/1http://www.securityfocus.com/bid/91483http://www.ubuntu.com/usn/USN-3010-1https://security.gentoo.org/glsa/201701-21https://source.android.com/security/bulletin/2016-11-01.htmlhttps://www.tenable.com/security/tns-2016-20
2016-06-16
Published