Skip to content
OpenAdvisories
High USN-5293-2 1 CVE

c3p0 vulnerability

Published Feb 22, 2022 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

USN-5293-1 fixed a vulnerability in c3p0.
This update provides the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

Aaron Massey discovered that c3p0 could be made to crash when
parsing certain input. An attacker able to modify the application's
XML configuration file could cause a denial of service.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS c3p0 0.9.1.2-9+deb8u1ubuntu0.16.04.1~esm1

Vulnerabilities 1

  • High 7.5
    CVE-2019-5427 Public exploit

    Billion laughs attack in c3p0

    c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

    c3p0 com.mchange:c3p0 c3p0 Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2019-5427