# CVE-2012-1148: libxmltok1t64: Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers...

CVE-2012-1148 is fixed in 7 products on 1 platform, first by libxmltok1 1.2-4ubuntu0.18.04.1~esm5, released July 2, 2012. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2012-1148
- Priority: Routine
- CVSS: n/a (Low)
- EPSS: 0.0343
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 2, 2012

## Description

Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libxmlrpc-c++8t64 Ubuntu 24.10 (oracular) | 1.16.33-3.1ubuntu6 | [libxmlrpc-c++8t64 1.16.33-3.1ubuntu6](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libxmlrpc-c-8t64-1.16.33-3.1ubuntu6.md) | Jul 3, 2012 |
| Linux | libxmlrpc-c++9 Ubuntu 25.04 (plucky) | 1.16.33-3.1ubuntu6 | [libxmlrpc-c++9 1.16.33-3.1ubuntu6](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libxmlrpc-c-9-1.16.33-3.1ubuntu6.md) | Jul 3, 2012 |
| Linux | libxmlrpc-core-c3t64 Ubuntu 24.10 (oracular) | 1.16.33-3.1ubuntu6 | [libxmlrpc-core-c3t64 1.16.33-3.1ubuntu6](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libxmlrpc-core-c3t64-1.16.33-3.1ubuntu6.md) | Jul 3, 2012 |
| Linux | libxmlrpc-core-c3t64 Ubuntu 25.04 (plucky) | 1.16.33-3.1ubuntu6 | [libxmlrpc-core-c3t64 1.16.33-3.1ubuntu6](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libxmlrpc-core-c3t64-1.16.33-3.1ubuntu6.md) | Jul 3, 2012 |
| Linux | libxmlrpc-util4 Ubuntu 25.04 (plucky) | 1.16.33-3.1ubuntu6 | [libxmlrpc-util4 1.16.33-3.1ubuntu6](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libxmlrpc-util4-1.16.33-3.1ubuntu6.md) | Jul 3, 2012 |
| Linux | libxmltok1 Ubuntu 18.04.6 LTS (bionic) | 1.2-4ubuntu0.18.04.1~esm5 | [libxmltok1 1.2-4ubuntu0.18.04.1~esm5](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libxmltok1-1.2-4ubuntu0.18.04.1-esm5.md) | Jul 2, 2012 |
| Linux | libxmltok1 Ubuntu 20.04 LTS (focal) | 1.2-4ubuntu0.20.04.1~esm5 | [libxmltok1 1.2-4ubuntu0.20.04.1~esm5](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libxmltok1-1.2-4ubuntu0.20.04.1-esm5.md) | Jul 2, 2012 |
| Linux | libxmltok1 Ubuntu 22.04.1 LTS (jammy) | 1.2-4ubuntu0.22.04.1~esm5 | [libxmltok1 1.2-4ubuntu0.22.04.1~esm5](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libxmltok1-1.2-4ubuntu0.22.04.1-esm5.md) | Jul 2, 2012 |
| Linux | libxmltok1t64 Ubuntu 24.04.5 LTS (noble) | 1.2-4.1ubuntu2.24.0.4.1+esm3 | [libxmltok1t64 1.2-4.1ubuntu2.24.0.4.1+esm3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libxmltok1t64-1.2-4.1ubuntu2.24.0.4.1-esm3.md) | Jul 2, 2012 |
| Linux | libxmltok1t64 Ubuntu 24.10 (oracular) | 1.2-4.1ubuntu3.2 | [libxmltok1t64 1.2-4.1ubuntu3.2](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libxmltok1t64-1.2-4.1ubuntu3.2.md) | Jul 3, 2012 |
| Linux | libxmltok1t64 Ubuntu 25.04 (plucky) | 1.2-4.1ubuntu4 | [libxmltok1t64 1.2-4.1ubuntu4](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libxmltok1t64-1.2-4.1ubuntu4.md) | Jul 3, 2012 |
| Linux | xmlrpc-api-utils Ubuntu 24.10 (oracular) | 1.16.33-3.1ubuntu6 | [xmlrpc-api-utils 1.16.33-3.1ubuntu6](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-xmlrpc-api-utils-1.16.33-3.1ubuntu6.md) | Jul 3, 2012 |
| Linux | xmlrpc-api-utils Ubuntu 25.04 (plucky) | 1.16.33-3.1ubuntu6 | [xmlrpc-api-utils 1.16.33-3.1ubuntu6](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-xmlrpc-api-utils-1.16.33-3.1ubuntu6.md) | Jul 3, 2012 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo