CVE-2009-3720

State: Published
Severity: Not scored
Published: Nov 3, 2009
Updated: Aug 7, 2024
Reserved: Oct 16, 2009

Description

The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

SSA:2011-041-02vendor-advisory
http://svn.python.org/view?view=rev&revision=74429
MDVSA-2009:215vendor-advisory
FEDORA-2010-17807vendor-advisory
FEDORA-2009-12753vendor-advisory
FEDORA-2009-12690vendor-advisory
38832third-party-advisory
RHSA-2010:0002vendor-advisory
MDVSA-2009:216vendor-advisory
USN-890-1vendor-advisory
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch
http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?view=log
SUSE-SR:2009:018vendor-advisory
[oss-security] 20091022 Re: Regarding expat bug 1990430mailing-list
MDVSA-2009:220vendor-advisory
[expat-bugs] 20090117 [ expat-Bugs-1990430 ] Parser crash with specially formatted UTF-8 sequencesmailing-list
38794third-party-advisory
[security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updatesmailing-list
oval:org.mitre.oval:def:11019vdb-entrysignature
ADV-2010-1107vdb-entry
MDVSA-2009:211vendor-advisory
[oss-security] 20090826 Re: Re: expat bug 1990430mailing-list
41701third-party-advisory
SUSE-SR:2010:011vendor-advisory
[oss-security] 20090821 expat bug 1990430mailing-list
37925third-party-advisory
38050third-party-advisory
1023160vdb-entry
SUSE-SR:2010:013vendor-advisory
oval:org.mitre.oval:def:7112vdb-entrysignature
https://bugzilla.redhat.com/show_bug.cgi?id=531697
FEDORA-2010-17720vendor-advisory
[oss-security] 20091022 Re: Re: Regarding expat bug 1990430mailing-list
USN-890-6vendor-advisory
[oss-security] 20091026 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430]mailing-list
FEDORA-2010-17732vendor-advisory
[oss-security] 20090826 Re: expat bug 1990430mailing-list
42338third-party-advisory
https://bugs.gentoo.org/show_bug.cgi?id=280615
FEDORA-2009-12737vendor-advisory
38231third-party-advisory
ADV-2010-3053vdb-entry
[oss-security] 20091028 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430]mailing-list
FEDORA-2010-17762vendor-advisory
SUSE-SR:2010:012vendor-advisory
MDVSA-2009:212vendor-advisory
MDVSA-2009:218vendor-advisory
38834third-party-advisory
ADV-2010-3061vdb-entry
http://sourceforge.net/tracker/index.php?func=detail&aid=1990430&group_id=10127&atid=110127
39478third-party-advisory
SUSE-SR:2010:014vendor-advisory
37537third-party-advisory
[oss-security] 20091022 Regarding expat bug 1990430mailing-list
oval:org.mitre.oval:def:12719vdb-entrysignature
43300third-party-advisory
RHSA-2011:0896vendor-advisory
ADV-2010-0896vdb-entry
273630vendor-advisory
HPSBUX02645vendor-advisory
[oss-security] 20090827 Re: Re: expat bug 1990430mailing-list
FEDORA-2010-17819vendor-advisory
[oss-security] 20090906 Re: Re: expat bug 1990430mailing-list
[oss-security] 20091023 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430]mailing-list
ADV-2011-0359vdb-entry
MDVSA-2009:219vendor-advisory
ADV-2010-3035vdb-entry
MDVSA-2009:217vendor-advisory
37324third-party-advisory
42326third-party-advisory
ADV-2010-0528vdb-entry
[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/mailing-list
[httpd-cvs] 20210330 svn commit: r1888194 [6/13] - /httpd/site/trunk/content/security/json/mailing-list
[httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20210330 svn commit: r1073139 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/json/mailing-list
[httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/mailing-list
[httpd-cvs] 20210330 svn commit: r1073149 [7/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/mailing-list
[httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/mailing-list
[httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list
[httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.