CVE-2009-1955

State: Published
Severity: Not scored
Published: Jun 6, 2009
Updated: Aug 7, 2024
Reserved: Jun 6, 2009

Description

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

35487third-party-advisory
DSA-1812vendor-advisory
http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3
ADV-2009-1907vdb-entry
FEDORA-2009-5969vendor-advisory
35444third-party-advisory
[apr-dev] 20090602 [PATCH] prevent "billion laughs" attack against expatmailing-list
MDVSA-2009:131vendor-advisory
oval:org.mitre.oval:def:10270vdb-entrysignature
35360third-party-advisory
ADV-2010-1107vdb-entry
[oss-security] 20090603 CVE request: "billion laughs" attack against Apache APRmailing-list
35395third-party-advisory
PK99478vendor-advisory
20090824 rPSA-2009-0123-1 apr-utilmailing-list
SUSE-SR:2010:011vendor-advisory
35284third-party-advisory
PK91241vendor-advisory
36473third-party-advisory
PK88342vendor-advisory
35843third-party-advisory
FEDORA-2009-6014vendor-advisory
RHSA-2009:1108vendor-advisory
HPSBUX02612vendor-advisory
oval:org.mitre.oval:def:12473vdb-entrysignature
35797third-party-advisory
http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
GLSA-200907-03vendor-advisory
http://svn.apache.org/viewvc?view=rev&revision=781403
FEDORA-2009-6261vendor-advisory
USN-786-1vendor-advisory
34724third-party-advisory
37221third-party-advisory
35565third-party-advisory
ADV-2009-3184vdb-entry
http://wiki.rpath.com/Advisories:rPSA-2009-0123
8842exploit
SSA:2009-167-02vendor-advisory
http://www-01.ibm.com/support/docview.wss?uid=swg27014463
APPLE-SA-2009-11-09-1vendor-advisory
MDVSA-2013:150vendor-advisory
35710third-party-advisory
35253vdb-entry
RHSA-2009:1107vendor-advisory
http://support.apple.com/kb/HT3937
USN-787-1vendor-advisory
[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/mailing-list
[httpd-cvs] 20210330 svn commit: r1888194 [6/13] - /httpd/site/trunk/content/security/json/mailing-list
[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20210330 svn commit: r1073139 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/json/mailing-list
[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/mailing-list
[httpd-cvs] 20210330 svn commit: r1073149 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/mailing-list
[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.