CVE - CVE-2009-2625

CVE-ID
CVE-2009-2625	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BUGTRAQ:20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components URL:http://www.securityfocus.com/archive/1/507985/100/0/threaded MLIST:[oss-security] 20090906 Re: Re: expat bug 1990430 URL:http://www.openwall.com/lists/oss-security/2009/09/06/1 MLIST:[oss-security] 20091022 Re: Regarding expat bug 1990430 URL:http://www.openwall.com/lists/oss-security/2009/10/22/9 MLIST:[oss-security] 20091023 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430] URL:http://www.openwall.com/lists/oss-security/2009/10/23/6 MLIST:[oss-security] 20091026 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430] URL:http://www.openwall.com/lists/oss-security/2009/10/26/3 MISC:http://www.cert.fi/en/reports/2009/vulnerability2009085.html MISC:http://www.codenomicon.com/labs/xml/ MISC:http://www.networkworld.com/columnists/2009/080509-xml-flaw.html CONFIRM:http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html CONFIRM:http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055&r2=787352&pathrev=787353&diff_format=h CONFIRM:http://www.vmware.com/security/advisories/VMSA-2009-0016.html CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=512921 CONFIRM:http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html APPLE:APPLE-SA-2009-09-03-1 URL:http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html DEBIAN:DSA-1984 URL:http://www.debian.org/security/2010/dsa-1984 FEDORA:FEDORA-2009-8329 URL:https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html FEDORA:FEDORA-2009-8337 URL:https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html HP:HPSBUX02476 URL:http://marc.info/?l=bugtraq&m=125787273209737&w=2 HP:SSRT090250 URL:http://marc.info/?l=bugtraq&m=125787273209737&w=2 MANDRIVA:MDVSA-2009:209 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2009:209 MANDRIVA:MDVSA-2011:108 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2011:108 REDHAT:RHSA-2009:1199 URL:https://rhn.redhat.com/errata/RHSA-2009-1199.html REDHAT:RHSA-2009:1200 URL:https://rhn.redhat.com/errata/RHSA-2009-1200.html REDHAT:RHSA-2009:1201 URL:https://rhn.redhat.com/errata/RHSA-2009-1201.html REDHAT:RHSA-2009:1615 URL:http://www.redhat.com/support/errata/RHSA-2009-1615.html REDHAT:RHSA-2009:1636 URL:https://rhn.redhat.com/errata/RHSA-2009-1636.html REDHAT:RHSA-2009:1637 URL:https://rhn.redhat.com/errata/RHSA-2009-1637.html REDHAT:RHSA-2009:1649 URL:https://rhn.redhat.com/errata/RHSA-2009-1649.html REDHAT:RHSA-2009:1650 URL:https://rhn.redhat.com/errata/RHSA-2009-1650.html REDHAT:RHSA-2011:0858 URL:http://www.redhat.com/support/errata/RHSA-2011-0858.html REDHAT:RHSA-2012:1232 URL:http://rhn.redhat.com/errata/RHSA-2012-1232.html REDHAT:RHSA-2012:1537 URL:http://rhn.redhat.com/errata/RHSA-2012-1537.html SLACKWARE:SSA:2011-041-02 URL:http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026 SUNALERT:263489 URL:http://sunsolve.sun.com/search/document.do?assetkey=1-66-263489-1 SUNALERT:272209 URL:http://sunsolve.sun.com/search/document.do?assetkey=1-66-272209-1 SUNALERT:1021506 URL:http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021506.1-1 SUSE:SUSE-SR:2009:016 URL:http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html SUSE:SUSE-SA:2009:053 URL:http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html SUSE:SUSE-SR:2009:017 URL:http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html SUSE:SUSE-SR:2010:013 URL:http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html UBUNTU:USN-890-1 URL:http://www.ubuntu.com/usn/USN-890-1 CERT:TA09-294A URL:http://www.us-cert.gov/cas/techalerts/TA09-294A.html CERT:TA10-012A URL:http://www.us-cert.gov/cas/techalerts/TA10-012A.html BID:35958 URL:http://www.securityfocus.com/bid/35958 OVAL:oval:org.mitre.oval:def:8520 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8520 OVAL:oval:org.mitre.oval:def:9356 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9356 SECTRACK:1022680 URL:http://www.securitytracker.com/id?1022680 SECUNIA:36162 URL:http://secunia.com/advisories/36162 SECUNIA:36176 URL:http://secunia.com/advisories/36176 SECUNIA:36180 URL:http://secunia.com/advisories/36180 SECUNIA:36199 URL:http://secunia.com/advisories/36199 SECUNIA:37300 URL:http://secunia.com/advisories/37300 SECUNIA:37460 URL:http://secunia.com/advisories/37460 SECUNIA:37671 URL:http://secunia.com/advisories/37671 SECUNIA:37754 URL:http://secunia.com/advisories/37754 SECUNIA:38342 URL:http://secunia.com/advisories/38342 SECUNIA:38231 URL:http://secunia.com/advisories/38231 SECUNIA:43300 URL:http://secunia.com/advisories/43300 SECUNIA:50549 URL:http://secunia.com/advisories/50549 VUPEN:ADV-2009-2543 URL:http://www.vupen.com/english/advisories/2009/2543 VUPEN:ADV-2009-3316 URL:http://www.vupen.com/english/advisories/2009/3316 VUPEN:ADV-2011-0359 URL:http://www.vupen.com/english/advisories/2011/0359
Assigning CNA
N/A
Date Entry Created
20090728	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20090728)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org