vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2012-0039

HIGH
7.5
CVSS Score
Published: January 14, 2012 at 05:00 PM UTC
Updated: June 16, 2026 at 11:36 PM UTC
1 product affected across 1 vendorGLib

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 2%
SSVC
No known exploit

Description

GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

GLib· Gnome
95%
v ≤ 2.31.81.1.121.1.12-11.1.151.2.01.2.11.2.101.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.91.3.101.3.111.3.121.3.131.3.141.3.151.3.92.02.0.02.0.12.0.22.0.32.0.42.0.52.0.62.0.72.1.02.1.12.1.22.1.32.1.42.1.52.10.02.10.12.10.22.10.32.11.02.11.12.11.22.11.32.11.42.12.02.12.12.12.102.12.112.12.122.12.132.12.22.12.32.12.42.12.52.12.62.12.72.12.82.12.92.13.02.13.12.13.22.13.32.13.42.13.52.13.62.13.72.14.02.14.12.14.22.14.32.14.42.14.52.14.62.15.02.15.12.15.22.15.32.15.42.15.52.15.62.16.02.16.12.16.22.16.32.16.42.16.52.16.62.17.02.17.12.17.22.17.32.17.42.17.52.17.62.17.72.18.02.18.12.18.22.18.32.18.42.19.02.19.12.19.102.19.22.19.32.19.42.19.52.19.62.19.72.19.82.19.92.2.02.2.12.2.22.2.32.20.02.20.12.20.22.20.32.20.42.20.52.21.02.21.12.21.22.21.32.21.42.21.52.21.62.22.02.22.12.22.22.22.32.22.42.22.52.23.02.23.12.23.22.23.32.23.42.23.52.23.62.24.02.24.12.24.22.25.02.25.12.25.102.25.112.25.122.25.132.25.142.25.152.25.162.25.172.25.22.25.32.25.42.25.52.25.62.25.72.25.82.25.92.26.02.26.12.27.02.27.12.27.22.27.32.27.42.27.52.27.902.27.912.27.922.27.932.282.28.02.28.12.28.22.28.32.28.42.28.52.28.62.28.72.28.82.29.102.29.122.29.142.29.162.29.182.29.22.29.42.29.62.29.82.29.902.29.922.3.02.3.12.3.22.3.32.3.42.3.52.3.62.30.02.30.12.30.22.31.02.31.22.31.42.31.62.4.02.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.82.5.02.5.12.5.22.5.32.5.42.5.52.5.62.5.72.6.02.6.12.6.22.6.32.6.42.6.52.6.62.7.02.7.12.7.22.7.32.7.42.7.52.7.62.7.72.8.02.8.12.8.22.8.32.8.42.8.52.8.62.9.02.9.12.9.22.9.32.9.42.9.52.9.6

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (4)

Source: [email protected]
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=655044
Mailing List
Source: [email protected]
http://mail.gnome.org/archives/gtk-devel-list/2003-May/msg00111.html
Mailing List
Source: [email protected]
http://openwall.com/lists/oss-security/2012/01/10/12
Source: [email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=772720

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHCISA-ADP
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-310

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card