CVE-2009-2625

Published: Aug 6, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

Affected (56)

Products: Oracle: Jdk, Primavera P6 Enterprise Project Portfolio Management, Primavera Web Services · Fedoraproject: Fedora · Opensuse: Opensuse · +4 more

Show all products

Oracle: Jdk, Primavera P6 Enterprise Project Portfolio Management, Primavera Web Services · Fedoraproject: Fedora · Opensuse: Opensuse · Suse: Linux Enterprise Server · Debian: Debian Linux · Canonical: Ubuntu Linux · Apache: Xerces2 Java

Oracle

3 products

Jdk

Primavera P6 Enterprise Project Portfolio Management

Primavera Web Services

1 product

1 product

1 product

Linux Enterprise Server

1 product

1 product

1 product

Configuration A

33 vulnerable

Vulnerable Software	Affected Versions
Oracle Jdk	Version 1.5.0
Oracle Jdk	Version 1.5.0 update10
Oracle Jdk	Version 1.5.0 update11
Oracle Jdk	Version 1.5.0 update12
Oracle Jdk	Version 1.5.0 update13
Oracle Jdk	Version 1.5.0 update14
Oracle Jdk	Version 1.5.0 update15
Oracle Jdk	Version 1.5.0 update16
Oracle Jdk	Version 1.5.0 update17
Oracle Jdk	Version 1.5.0 update18
Oracle Jdk	Version 1.5.0 update19
Oracle Jdk	Version 1.5.0 update1
Oracle Jdk	Version 1.5.0 update2
Oracle Jdk	Version 1.5.0 update3
Oracle Jdk	Version 1.5.0 update4
Oracle Jdk	Version 1.5.0 update5
Oracle Jdk	Version 1.5.0 update6
Oracle Jdk	Version 1.5.0 update7
Oracle Jdk	Version 1.5.0 update8
Oracle Jdk	Version 1.5.0 update9
Oracle Jdk	Version 1.6.0
Oracle Jdk	Version 1.6.0 update10
Oracle Jdk	Version 1.6.0 update11
Oracle Jdk	Version 1.6.0 update12
Oracle Jdk	Version 1.6.0 update13
Oracle Jdk	Version 1.6.0 update14
Oracle Jdk	Version 1.6.0 update1
Oracle Jdk	Version 1.6.0 update2
Oracle Jdk	Version 1.6.0 update3
Oracle Jdk	Version 1.6.0 update4
Oracle Jdk	Version 1.6.0 update5
Oracle Jdk	Version 1.6.0 update6
Oracle Jdk	Version 1.6.0 update7

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 10
Fedoraproject Fedora	Version 11

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.0
Opensuse Opensuse	Version 11.1
Opensuse Opensuse	Version 11.2
Suse Linux Enterprise Server	Version 10 sp2
Suse Linux Enterprise Server	Version 10 sp3
Suse Linux Enterprise Server	Version 11
Suse Linux Enterprise Server	Version 9

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 5.0

Configuration E

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10
Canonical Ubuntu Linux	Version 9.04
Canonical Ubuntu Linux	Version 9.10

Configuration F

6 vulnerable

Vulnerable Software	Affected Versions
Oracle Primavera P6 Enterprise Project Portfolio Management	Version 6.1
Oracle Primavera P6 Enterprise Project Portfolio Management	Version 6.2.1
Oracle Primavera P6 Enterprise Project Portfolio Management	Version 7.0
Oracle Primavera Web Services	Version 6.2.1
Oracle Primavera Web Services	Version 7.0
Oracle Primavera Web Services	Version 7.0 sp1

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Apache Xerces2 Java	Version 2.9.1

References (126)

http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html

Source: cret@cert.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html

Source: cret@cert.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html

Source: cret@cert.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html

Source: cret@cert.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html

Source: cret@cert.org

Third Party Advisory

http://marc.info/?l=bugtraq&m=125787273209737&w=2

Source: cret@cert.org

Mailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2012-1232.html

Source: cret@cert.org

Broken Link

http://rhn.redhat.com/errata/RHSA-2012-1537.html

Source: cret@cert.org

Broken Link

http://secunia.com/advisories/36162

Source: cret@cert.org

Third Party Advisory

http://secunia.com/advisories/36176

Source: cret@cert.org

Third Party Advisory

http://secunia.com/advisories/36180

Source: cret@cert.org

Third Party Advisory

http://secunia.com/advisories/36199

Source: cret@cert.org

Third Party Advisory

http://secunia.com/advisories/37300

Source: cret@cert.org

Third Party Advisory

http://secunia.com/advisories/37460

Source: cret@cert.org

Third Party Advisory

http://secunia.com/advisories/37671

Source: cret@cert.org

Third Party Advisory

http://secunia.com/advisories/37754

Source: cret@cert.org

Third Party Advisory

http://secunia.com/advisories/38231

Source: cret@cert.org

Third Party Advisory

http://secunia.com/advisories/38342

Source: cret@cert.org

Third Party Advisory

http://secunia.com/advisories/43300

Source: cret@cert.org

Third Party Advisory

http://secunia.com/advisories/50549

Source: cret@cert.org

Third Party Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026

Source: cret@cert.org

Third Party Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1

Source: cret@cert.org

Broken LinkPatch

http://sunsolve.sun.com/search/document.do?assetkey=1-66-263489-1

Source: cret@cert.org

Broken LinkPatchVendor Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-66-272209-1

Source: cret@cert.org

Broken Link

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021506.1-1

Source: cret@cert.org

Broken Link

http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055&r2=787352&pathrev=787353&diff_format=h

Source: cret@cert.org

PatchVendor Advisory

http://www.cert.fi/en/reports/2009/vulnerability2009085.html

Source: cret@cert.org

Third Party Advisory

http://www.codenomicon.com/labs/xml/

Source: cret@cert.org

Third Party Advisory

http://www.debian.org/security/2010/dsa-1984

Source: cret@cert.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:209

Source: cret@cert.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2011:108

Source: cret@cert.org

Third Party Advisory

http://www.networkworld.com/columnists/2009/080509-xml-flaw.html

Source: cret@cert.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2009/09/06/1

Source: cret@cert.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2009/10/22/9

Source: cret@cert.org

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2009/10/23/6

Source: cret@cert.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2009/10/26/3

Source: cret@cert.org

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html

Source: cret@cert.org

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html

Source: cret@cert.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2009-1615.html

Source: cret@cert.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2011-0858.html

Source: cret@cert.org

Third Party Advisory

http://www.securityfocus.com/archive/1/507985/100/0/threaded

Source: cret@cert.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/35958

Source: cret@cert.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1022680

Source: cret@cert.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-890-1

Source: cret@cert.org

Third Party Advisory

http://www.us-cert.gov/cas/techalerts/TA09-294A.html

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

http://www.us-cert.gov/cas/techalerts/TA10-012A.html

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Source: cret@cert.org

Third Party Advisory

http://www.vupen.com/english/advisories/2009/2543

Source: cret@cert.org

Permissions Required

http://www.vupen.com/english/advisories/2009/3316

Source: cret@cert.org

Permissions Required

http://www.vupen.com/english/advisories/2011/0359

Source: cret@cert.org

Permissions Required

https://bugzilla.redhat.com/show_bug.cgi?id=512921

Source: cret@cert.org

Issue TrackingThird Party Advisory

https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E

Source: cret@cert.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8520

Source: cret@cert.org

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9356

Source: cret@cert.org

Third Party Advisory

https://rhn.redhat.com/errata/RHSA-2009-1199.html

Source: cret@cert.org

Broken Link

https://rhn.redhat.com/errata/RHSA-2009-1200.html

Source: cret@cert.org

Broken Link

https://rhn.redhat.com/errata/RHSA-2009-1201.html

Source: cret@cert.org

Broken Link

https://rhn.redhat.com/errata/RHSA-2009-1636.html

Source: cret@cert.org

Broken Link

https://rhn.redhat.com/errata/RHSA-2009-1637.html

Source: cret@cert.org

Broken Link

https://rhn.redhat.com/errata/RHSA-2009-1649.html

Source: cret@cert.org

Broken Link

https://rhn.redhat.com/errata/RHSA-2009-1650.html

Source: cret@cert.org

Broken Link

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html

Source: cret@cert.org

Mailing ListThird Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html

Source: cret@cert.org

Mailing ListThird Party Advisory

http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html