expat: denial of service [LWN.net]

Package(s):

expat

CVE #(s):

CVE-2009-2625

Created:

August 24, 2009

Updated:

June 13, 2011

Description:

From the Gentoo bug report:

Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

Alerts:

Mandriva	MDVSA-2011:108	xerces-j2	2011-06-13
Scientific Linux	SL-xerc-20110608	xerces-j2	2011-06-08
Slackware	SSA:2011-041-02	expat	2011-02-11
SUSE	SUSE-SR:2010:015	gpg2, krb5, kvirc, libpcsclite1/pcsc-lite, libpython2_6-1_0, libvorbis, libwebkit, squidGuard, strongswan	2010-08-17
SUSE	SUSE-SR:2010:014	OpenOffice_org, apache2-slms, aria2, bogofilter, cifs-mount/samba, clamav, exim, ghostscript-devel, gnutls, krb5, kvirc, lftp, libpython2_6-1_0, libtiff, libvorbis, lxsession, mono-addon-bytefx-data-mysql/bytefx-data-mysql, moodle, openldap2, opera, otrs, popt, postgresql, python-mako, squidGuard, vte, w3m, xmlrpc-c, XFree86/xorg-x11, yast2-webclient	2010-08-02
SuSE	SUSE-SR:2010:012	evolution-data-server, python/libpython2_6-1_0, mozilla-nss, memcached, texlive/te_ams, mono/bytefx-data-mysql, libpng-devel, apache2-mod_php5, ncpfs, pango, libcmpiutil	2010-05-25
SuSE	SUSE-SR:2010:011	dovecot12, cacti, java-1_6_0-openjdk, irssi, tar, fuse, apache2, libmysqlclient-devel, cpio, moodle, libmikmod, libicecore, evolution-data-server, libpng/libpng-devel, libesmtp	2010-05-10
SuSE	SUSE-SR:2010:013	apache2-mod_php5/php5, bytefx-data-mysql/mono, flash-player, fuse, java-1_4_2-ibm, krb5, libcmpiutil/libvirt, libmozhelper-1_0-0/mozilla-xulrunner190, libopenssl-devel, libpng12-0, libpython2_6-1_0, libtheora, memcached, ncpfs, pango, puppet, python, seamonkey, te_ams, texlive	2010-06-14
Ubuntu	USN-890-6	cmake	2010-04-15
Ubuntu	USN-890-4	python-xml	2010-01-26
Ubuntu	USN-890-3	python2.4	2010-01-22
Ubuntu	USN-890-2	python2.5	2010-01-21
Ubuntu	USN-890-1	expat	2010-01-20
Mandriva	MDVSA-2009:316-1	expat	2010-01-08
Mandriva	MDVSA-2009:220-1	davfs	2010-01-05
CentOS	CESA-2009:1615	xerces-j2	2009-12-17
Mandriva	MDVSA-2009:212-1	python	2009-12-04
Mandriva	MDVSA-2009:213-1	wxgtk	2009-12-04
Mandriva	MDVSA-2009:211-1	expat	2009-12-04
Mandriva	MDVSA-2009:218-1	w3c-libwww	2009-12-04
Mandriva	MDVSA-2009:217-3	mozilla-thunderbird	2009-12-03
SuSE	SUSE-SR:2010:005	fetchmail, krb5, rubygem-actionpack-2_1, libexpat0, unbound, apache2-mod_php5/php5	2010-02-23
Ubuntu	USN-890-5	xmlrpc-c	2010-02-18
Red Hat	RHSA-2009:1236-01	java-1.5.0-ibm	2009-08-28
Mandriva	MDVSA-2009:220	davfs	2009-08-24
Mandriva	MDVSA-2009:219	kompozer	2009-08-24
Mandriva	MDVSA-2009:218	w3c-libwww	2009-08-24
Mandriva	MDVSA-2009:217	mozilla-thunderbird	2009-08-23
Mandriva	MDVSA-2009:216	mozilla-thunderbird	2009-08-23
Mandriva	MDVSA-2009:215	audacity	2009-08-23
Mandriva	MDVSA-2009:214	python-celementtree	2009-08-23
Mandriva	MDVSA-2009:213	wxgtk	2009-08-23
Mandriva	MDVSA-2009:212	python	2009-08-23
Mandriva	MDVSA-2009:211	expat	2009-08-23
SuSE	SUSE-SA:2009:053	java-1_6_0-ibm	2009-11-04
Debian	DSA-1984-1	libxerces2-java	2010-01-30
Debian	DSA-1921-1	expat	2009-10-28
Red Hat	RHSA-2009:1615-01	xerces-j2	2009-11-30