USN-7571-1

Aaron Massey discovered that c3p0 could be made to crash when parsing certain input. An attacker able to modify the application’s XML configuration file could possibly use this issue to cause a denial of service.

References

Affected packages

Ubuntu:Pro:14.04:LTS / c3p0

Package

Name: c3p0
Purl: pkg:deb/ubuntu/c3p0@0.9.1.2-9+deb8u1ubuntu0.14.04.1~esm1?arch=source&distro=esm-infra-legacy/trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.9.1.2-9+deb8u1ubuntu0.14.04.1~esm1

Affected versions

0.*

0.9.1.2-7

0.9.1.2-9

0.9.1.2-9+deb8u1build0.14.04.1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "0.9.1.2-9+deb8u1ubuntu0.14.04.1~esm1",
            "binary_name": "libc3p0-java"
        }
    ]
}