// For flags

CVE-2009-2414

mingw32-libxml2: Stack overflow by parsing root XML element DTD definition

Severity Score

4.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML fuzzing framework.

Vulnerabilidad de agotamiento de pila en libxml2 v2.5.10, v2.6.16, v2.6.26, v2.6.27, y v2.6.32, y libxml v1.8.17, permite a atacantes dependientes de contexto producir una denegación de servicio (caída de aplicación) a través de una declaración de elementos en una DTD, relacionada con la recursión de función, como se demostro en Codenomicon XML fuzzing framework.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2009-07-09 CVE Reserved
  • 2009-08-11 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (37)
URL Tag Source
http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html X_refsource_confirm
http://secunia.com/advisories/35036 Third Party Advisory
http://secunia.com/advisories/36207 Third Party Advisory
http://secunia.com/advisories/36338 Third Party Advisory
http://secunia.com/advisories/36417 Third Party Advisory
http://secunia.com/advisories/36631 Third Party Advisory
http://secunia.com/advisories/37346 Third Party Advisory
http://secunia.com/advisories/37471 Third Party Advisory
http://support.apple.com/kb/HT3937 X_refsource_confirm
http://support.apple.com/kb/HT3949 X_refsource_confirm
http://support.apple.com/kb/HT4225 X_refsource_confirm
http://www.cert.fi/en/reports/2009/vulnerability2009085.html X_refsource_misc
http://www.codenomicon.com/labs/xml X_refsource_misc
http://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg678527.html Mailing List
http://www.networkworld.com/columnists/2009/080509-xml-flaw.html X_refsource_misc
http://www.openoffice.org/security/cves/CVE-2009-2414-2416.html X_refsource_confirm
http://www.securityfocus.com/archive/1/507985/100/0/threaded Mailing List
http://www.securityfocus.com/bid/36010 Vdb Entry
http://www.vmware.com/security/advisories/VMSA-2009-0016.html X_refsource_confirm
http://www.vupen.com/english/advisories/2009/2420 Vdb Entry
http://www.vupen.com/english/advisories/2009/3184 Vdb Entry
http://www.vupen.com/english/advisories/2009/3217 Vdb Entry
http://www.vupen.com/english/advisories/2009/3316 Vdb Entry
https://git.gnome.org/browse/libxml2/commit/?id=489f9671e71cc44a97b23111b3126ac8a1e21a59 X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10129 Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8639 Signature
URL Date SRC
URL Date SRC
http://www.debian.org/security/2009/dsa-1859 2023-02-13
URL Date SRC
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html 2023-02-13
http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html 2023-02-13
http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html 2023-02-13
http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html 2023-02-13
http://www.ubuntu.com/usn/USN-815-1 2023-02-13
https://bugzilla.redhat.com/show_bug.cgi?id=515195 2009-08-10
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00537.html 2023-02-13
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00547.html 2023-02-13
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00642.html 2023-02-13
https://access.redhat.com/security/cve/CVE-2009-2414 2009-08-10
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Xmlsoft
Search vendor "Xmlsoft"
 Libxml
Search vendor "Xmlsoft" for product "Libxml"
 1.8.17
Search vendor "Xmlsoft" for product "Libxml" and version "1.8.17"
-
Affected
Xmlsoft
Search vendor "Xmlsoft"
 Libxml2
Search vendor "Xmlsoft" for product "Libxml2"
 2.5.10
Search vendor "Xmlsoft" for product "Libxml2" and version "2.5.10"
-
Affected
Xmlsoft
Search vendor "Xmlsoft"
 Libxml2
Search vendor "Xmlsoft" for product "Libxml2"
 2.6.16
Search vendor "Xmlsoft" for product "Libxml2" and version "2.6.16"
-
Affected
Xmlsoft
Search vendor "Xmlsoft"
 Libxml2
Search vendor "Xmlsoft" for product "Libxml2"
 2.6.26
Search vendor "Xmlsoft" for product "Libxml2" and version "2.6.26"
-
Affected
Xmlsoft
Search vendor "Xmlsoft"
 Libxml2
Search vendor "Xmlsoft" for product "Libxml2"
 2.6.27
Search vendor "Xmlsoft" for product "Libxml2" and version "2.6.27"
-
Affected
Xmlsoft
Search vendor "Xmlsoft"
 Libxml2
Search vendor "Xmlsoft" for product "Libxml2"
 2.6.32
Search vendor "Xmlsoft" for product "Libxml2" and version "2.6.32"
-
Affected