CVE-2009-1885

https://notcve.org/view.php?id=CVE-2009-1885

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework. Vulnerabilidad de agotamiento de pila en validators/DTD/DTDScanner.cpp en Apache Xerces C++ v2.7.0 y v2.8.0 permite a atacantes dependientes de contexto producir una denegación de servicio (caída de aplicación) a través de vectores que incluyen el uso de paréntesis anidados y unos valores de byte no validos en "estructuras simples anidadas DTD", como se demostro en Codenomicon XML fuzzing framework. • http://secunia.com/advisories/36201 http://svn.apache.org/viewvc/xerces/c/trunk/src/xercesc/validators/DTD/DTDScanner.cpp?r1=781488&r2=781487&pathrev=781488&view=patch http://svn.apache.org/viewvc?view=rev&revision=781488 http://www.cert.fi/en/reports/2009/vulnerability2009085.html http://www.codenomicon.com/labs/xml http://www.mandriva.com/security/advisories?name=MDVSA-2009:223 http://www.networkworld.com/columnists/2009/080509-xml-flaw.html http://www.securityfocus.com/bid/35986 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •