CVE-2012-0876

The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.

Date published : 2012-07-03

http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html

http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html