CVE-2009-2414: Buffer Overflow
First published: Mon Aug 03 2009(Updated: )
A stack overflow flaw was found in libxml by parsing root XML document element DTD definition. Providing a specially-crafted XML file would lead to excessive stack growth and denial of service (application crash), when opened by a victim.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| libxml2-devel | =2.6.16 | |
| libxml2-devel | =2.6.32 | |
| libxml2-devel | =2.6.26 | |
| libxml2-devel | =2.6.27 | |
| libxml2 | =1.8.17 | |
| libxml2-devel | =2.5.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.debian.org/security/2009/dsa-1859
- http://www.cert.fi/en/reports/2009/vulnerability2009085.html
- https://bugzilla.redhat.com/show_bug.cgi?id=515195
- http://www.networkworld.com/columnists/2009/080509-xml-flaw.html
- http://www.securityfocus.com/bid/36010
- http://www.codenomicon.com/labs/xml/
- https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00547.html
- https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00537.html
- http://www.ubuntu.com/usn/USN-815-1
- http://secunia.com/advisories/36338
- https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00642.html
- http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html
- http://secunia.com/advisories/36207
- http://www.vupen.com/english/advisories/2009/2420
- http://secunia.com/advisories/36417
- http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html
- http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
- http://support.apple.com/kb/HT3937
- http://support.apple.com/kb/HT3949
- http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html
- http://www.vupen.com/english/advisories/2009/3184
- http://secunia.com/advisories/37471
- http://www.vupen.com/english/advisories/2009/3316
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://secunia.com/advisories/37346
- http://www.vupen.com/english/advisories/2009/3217
- http://support.apple.com/kb/HT4225
- http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
- http://secunia.com/advisories/36631
- http://secunia.com/advisories/35036
- http://www.openoffice.org/security/cves/CVE-2009-2414-2416.html
- https://git.gnome.org/browse/libxml2/commit/?id=489f9671e71cc44a97b23111b3126ac8a1e21a59
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8639
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10129
- http://www.securityfocus.com/archive/1/507985/100/0/threaded
- http://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg678527.html
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=356032&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=356032&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=356033&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=356033&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=356035&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=356035&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=356048&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=356048&action=edit
- http://admin.fedoraproject.org/updates/libxml2-2.7.3-3.fc11
- http://admin.fedoraproject.org/updates/libxml2-2.7.3-2.fc10
- https://rhn.redhat.com/errata/RHSA-2009-1206.html
- http://admin.fedoraproject.org/updates/libxml-1.8.17-24.fc11
- http://admin.fedoraproject.org/updates/libxml-1.8.17-24.fc10
- http://admin.fedoraproject.org/updates/mingw32-libxml2-2.7.3-2.fc11
Frequently Asked Questions
What is the severity of CVE-2009-2414?
CVE-2009-2414 has a severity level that may lead to a denial of service due to a stack overflow in libxml.
How do I fix CVE-2009-2414?
To fix CVE-2009-2414, upgrade libxml2 to version 2.6.33 or later.
What versions of libxml2 are affected by CVE-2009-2414?
CVE-2009-2414 affects libxml2 versions 2.5.10 through 2.6.32.
Can CVE-2009-2414 be exploited remotely?
Yes, CVE-2009-2414 can be exploited remotely by sending a specially-crafted XML file.
What impact does CVE-2009-2414 have on applications?
CVE-2009-2414 can cause applications that use libxml2 to crash due to excessive stack growth.
- agent/references
- agent/first-publish-date
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/remedy
- agent/author
- agent/last-modified-date
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-2414
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/xmlsoft
- canonical/libxml2-devel
- version/libxml2-devel/2.6.16
- version/libxml2-devel/2.6.32
- version/libxml2-devel/2.6.26
- version/libxml2-devel/2.6.27
- canonical/libxml2
- version/libxml2/1.8.17
- version/libxml2-devel/2.5.10