Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
|
Configuration 8 (hide)
|
Configuration 9 (hide)
|
Configuration 10 (hide)
|
History
21 Nov 2024, 01:04
Type | Values Removed | Values Added |
---|---|---|
References | () http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html - Release Notes | |
References | () http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html - Mailing List | |
References | () http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html - Mailing List | |
References | () http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html - Mailing List | |
References | () http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html - Mailing List | |
References | () http://secunia.com/advisories/35036 - Broken Link | |
References | () http://secunia.com/advisories/36207 - Broken Link | |
References | () http://secunia.com/advisories/36338 - Broken Link | |
References | () http://secunia.com/advisories/36417 - Broken Link | |
References | () http://secunia.com/advisories/36631 - Broken Link | |
References | () http://secunia.com/advisories/37346 - Broken Link | |
References | () http://secunia.com/advisories/37471 - Broken Link | |
References | () http://support.apple.com/kb/HT3937 - Third Party Advisory | |
References | () http://support.apple.com/kb/HT3949 - Third Party Advisory | |
References | () http://support.apple.com/kb/HT4225 - Third Party Advisory | |
References | () http://www.cert.fi/en/reports/2009/vulnerability2009085.html - Broken Link | |
References | () http://www.codenomicon.com/labs/xml/ - Broken Link | |
References | () http://www.debian.org/security/2009/dsa-1859 - Mailing List, Patch | |
References | () http://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg678527.html - Patch | |
References | () http://www.networkworld.com/columnists/2009/080509-xml-flaw.html - Broken Link | |
References | () http://www.openoffice.org/security/cves/CVE-2009-2414-2416.html - Third Party Advisory | |
References | () http://www.securityfocus.com/archive/1/507985/100/0/threaded - Broken Link, Third Party Advisory, VDB Entry | |
References | () http://www.securityfocus.com/bid/36010 - Broken Link, Third Party Advisory, VDB Entry | |
References | () http://www.ubuntu.com/usn/USN-815-1 - Third Party Advisory | |
References | () http://www.vmware.com/security/advisories/VMSA-2009-0016.html - Third Party Advisory | |
References | () http://www.vupen.com/english/advisories/2009/2420 - Broken Link | |
References | () http://www.vupen.com/english/advisories/2009/3184 - Broken Link | |
References | () http://www.vupen.com/english/advisories/2009/3217 - Broken Link | |
References | () http://www.vupen.com/english/advisories/2009/3316 - Broken Link | |
References | () https://bugzilla.redhat.com/show_bug.cgi?id=515205 - Issue Tracking, Patch | |
References | () https://git.gnome.org/browse/libxml2/commit/?id=489f9671e71cc44a97b23111b3126ac8a1e21a59 - Patch | |
References | () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7783 - Broken Link | |
References | () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9262 - Broken Link | |
References | () https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00537.html - Mailing List | |
References | () https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00547.html - Mailing List | |
References | () https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00642.html - Mailing List |
02 Feb 2024, 16:04
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 6.5 |
First Time |
Suse linux Enterprise
Canonical ubuntu Linux Vmware esx Sun openoffice.org Opensuse Suse linux Enterprise Server Opensuse opensuse Sun Apple safari Google chrome Vmware vma Apple iphone Os Fedoraproject Vmware vcenter Server Redhat enterprise Linux Debian Apple Canonical Fedoraproject fedora Vmware Apple mac Os X Server Apple mac Os X Redhat Vmware esxi Suse Debian debian Linux |
|
References | () http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html - Release Notes | |
References | () http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html - Mailing List | |
References | () http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html - Mailing List | |
References | () http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html - Mailing List | |
References | () http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html - Mailing List | |
References | () http://secunia.com/advisories/35036 - Broken Link | |
References | () http://secunia.com/advisories/36207 - Broken Link | |
References | () http://secunia.com/advisories/36338 - Broken Link | |
References | () http://secunia.com/advisories/36417 - Broken Link | |
References | () http://secunia.com/advisories/36631 - Broken Link | |
References | () http://secunia.com/advisories/37346 - Broken Link | |
References | () http://secunia.com/advisories/37471 - Broken Link | |
References | () http://support.apple.com/kb/HT3937 - Third Party Advisory | |
References | () http://support.apple.com/kb/HT3949 - Third Party Advisory | |
References | () http://support.apple.com/kb/HT4225 - Third Party Advisory | |
References | () http://www.cert.fi/en/reports/2009/vulnerability2009085.html - Broken Link | |
References | () http://www.codenomicon.com/labs/xml/ - Broken Link | |
References | () http://www.debian.org/security/2009/dsa-1859 - Mailing List, Patch | |
References | () http://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg678527.html - Patch | |
References | () http://www.networkworld.com/columnists/2009/080509-xml-flaw.html - Broken Link | |
References | () http://www.openoffice.org/security/cves/CVE-2009-2414-2416.html - Third Party Advisory | |
References | () http://www.securityfocus.com/archive/1/507985/100/0/threaded - Broken Link, Third Party Advisory, VDB Entry | |
References | () http://www.securityfocus.com/bid/36010 - Broken Link, Third Party Advisory, VDB Entry | |
References | () http://www.ubuntu.com/usn/USN-815-1 - Third Party Advisory | |
References | () http://www.vmware.com/security/advisories/VMSA-2009-0016.html - Third Party Advisory | |
References | () http://www.vupen.com/english/advisories/2009/2420 - Broken Link | |
References | () http://www.vupen.com/english/advisories/2009/3184 - Broken Link | |
References | () http://www.vupen.com/english/advisories/2009/3217 - Broken Link | |
References | () http://www.vupen.com/english/advisories/2009/3316 - Broken Link | |
References | () https://bugzilla.redhat.com/show_bug.cgi?id=515205 - Issue Tracking, Patch | |
References | () https://git.gnome.org/browse/libxml2/commit/?id=489f9671e71cc44a97b23111b3126ac8a1e21a59 - Patch | |
References | () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7783 - Broken Link | |
References | () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9262 - Broken Link | |
References | () https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00537.html - Mailing List | |
References | () https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00547.html - Mailing List | |
References | () https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00642.html - Mailing List | |
CPE | cpe:2.3:o:vmware:esxi:3.5:*:*:*:*:*:*:* cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:* cpe:2.3:o:vmware:esx:4.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:* cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:* cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* cpe:2.3:a:vmware:vcenter_server:4.0:-:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:* cpe:2.3:a:vmware:vma:4.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* cpe:2.3:o:suse:linux_enterprise:10.0:-:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:* cpe:2.3:o:suse:linux_enterprise:11.0:-:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:3.0:*:*:*:*:*:*:* cpe:2.3:o:vmware:esxi:4.0:*:*:*:*:*:*:* cpe:2.3:o:vmware:esx:3.5:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:* cpe:2.3:a:sun:openoffice.org:*:*:*:*:*:*:*:* cpe:2.3:o:vmware:esx:3.0.3:*:*:*:*:*:*:* cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* |
|
CWE | CWE-416 |
Information
Published : 2009-08-11 18:30
Updated : 2025-04-09 00:30
NVD link : CVE-2009-2416
Mitre link : CVE-2009-2416
CVE.ORG link : CVE-2009-2416
JSON object : View
Products Affected
debian
- debian_linux
apple
- iphone_os
- mac_os_x_server
- mac_os_x
- safari
opensuse
- opensuse
vmware
- vma
- esxi
- esx
- vcenter_server
xmlsoft
- libxml
- libxml2
- chrome
canonical
- ubuntu_linux
suse
- linux_enterprise_server
- linux_enterprise
redhat
- enterprise_linux
fedoraproject
- fedora
sun
- openoffice.org
CWE
CWE-416
Use After Free