CVE-2009-2625
- State
- Published
- Severity
- Not scored
- Published
- Aug 6, 2009
- Updated
- Aug 7, 2024
- Reserved
- Jul 28, 2009
Description
XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- SSA:2011-041-02vendor-advisory
- RHSA-2009:1200vendor-advisory
- RHSA-2009:1199vendor-advisory
- http://www.networkworld.com/columnists/2009/080509-xml-flaw.html
- USN-890-1vendor-advisory
- 36162third-party-advisory
- ADV-2009-2543vdb-entry
- DSA-1984vendor-advisory
- [oss-security] 20091022 Re: Regarding expat bug 1990430mailing-list
- 1021506vendor-advisory
- 37460third-party-advisory
- RHSA-2009:1615vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- HPSBUX02476vendor-advisory
- 37754third-party-advisory
- RHSA-2009:1637vendor-advisory
- http://www.cert.fi/en/reports/2009/vulnerability2009085.html
- http://www.codenomicon.com/labs/xml/
- 36199third-party-advisory
- RHSA-2012:1537vendor-advisory
- SUSE-SR:2010:013vendor-advisory
- MDVSA-2009:209vendor-advisory
- FEDORA-2009-8329vendor-advisory
- RHSA-2011:0858vendor-advisory
- 1022680vdb-entry
- 37671third-party-advisory
- 38342third-party-advisory
- RHSA-2009:1636vendor-advisory
- 35958vdb-entry
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party componentsmailing-list
- RHSA-2009:1649vendor-advisory
- [oss-security] 20091026 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430]mailing-list
- TA09-294Athird-party-advisory
- 50549third-party-advisory
- oval:org.mitre.oval:def:8520vdb-entrysignature
- 36180third-party-advisory
- 38231third-party-advisory
- 272209vendor-advisory
- MDVSA-2011:108vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
- http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1
- 36176third-party-advisory
- FEDORA-2009-8337vendor-advisory
- 43300third-party-advisory
- oval:org.mitre.oval:def:9356vdb-entrysignature
- TA10-012Athird-party-advisory
- SUSE-SR:2009:016vendor-advisory
- RHSA-2012:1232vendor-advisory
- 263489vendor-advisory
- http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055&r2=787352&pathrev=787353&diff_format=h
- 37300third-party-advisory
- APPLE-SA-2009-09-03-1vendor-advisory
- SUSE-SA:2009:053vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=512921
- RHSA-2009:1201vendor-advisory
- SUSE-SR:2009:017vendor-advisory
- [oss-security] 20090906 Re: Re: expat bug 1990430mailing-list
- [oss-security] 20091023 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430]mailing-list
- ADV-2011-0359vdb-entry
- ADV-2009-3316vdb-entry
- RHSA-2009:1650vendor-advisory
- [lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.