5

CVE-2012-0840

tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.

Data is provided by the National Vulnerability Database (NVD)
Apache ≫ Portable Runtime Version <= 1.4.5
Apache ≫ Portable Runtime Version0.9.1
Apache ≫ Portable Runtime Version0.9.2
Apache ≫ Portable Runtime Version0.9.2-dev
Apache ≫ Portable Runtime Version0.9.3
Apache ≫ Portable Runtime Version0.9.3-dev
Apache ≫ Portable Runtime Version0.9.4
Apache ≫ Portable Runtime Version0.9.5
Apache ≫ Portable Runtime Version0.9.6
Apache ≫ Portable Runtime Version0.9.7
Apache ≫ Portable Runtime Version0.9.7-dev
Apache ≫ Portable Runtime Version0.9.8
Apache ≫ Portable Runtime Version0.9.9
Apache ≫ Portable Runtime Version0.9.16-dev
Apache ≫ Portable Runtime Version1.3.0
Apache ≫ Portable Runtime Version1.3.1
Apache ≫ Portable Runtime Version1.3.2
Apache ≫ Portable Runtime Version1.3.3
Apache ≫ Portable Runtime Version1.3.4
Apache ≫ Portable Runtime Version1.3.4-dev
Apache ≫ Portable Runtime Version1.3.5
Apache ≫ Portable Runtime Version1.3.6
Apache ≫ Portable Runtime Version1.3.6-dev
Apache ≫ Portable Runtime Version1.3.7
Apache ≫ Portable Runtime Version1.3.8
Apache ≫ Portable Runtime Version1.3.9
Apache ≫ Portable Runtime Version1.3.10
Apache ≫ Portable Runtime Version1.3.11
Apache ≫ Portable Runtime Version1.3.12
Apache ≫ Portable Runtime Version1.3.13
Apache ≫ Portable Runtime Version1.4.0
Apache ≫ Portable Runtime Version1.4.1
Apache ≫ Portable Runtime Version1.4.2
Apache ≫ Portable Runtime Version1.4.3
Apache ≫ Portable Runtime Version1.4.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 31.95% 0.967
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.