CVE-2012-0039

Name	CVE-2012-0039
Description	GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	655044

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glib2.0 (PTS)	jessie, jessie (lts)	2.42.1-1+deb8u7	vulnerable
	stretch (security)	2.50.3-2+deb9u3	vulnerable
	stretch (lts), stretch	2.50.3-2+deb9u6	vulnerable
	buster (security), buster, buster (lts)	2.58.3-2+deb10u6	vulnerable
	bullseye	2.66.8-1+deb11u4	vulnerable
	bullseye (security)	2.66.8-1+deb11u3	vulnerable
	bookworm	2.74.6-2+deb12u4	vulnerable
	bookworm (security)	2.74.6-2+deb12u2	vulnerable
	trixie	2.82.2-2	vulnerable
	sid	2.82.2-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
glib2.0	source	(unstable)	(unfixed)	unimportant		655044