CVE-2009-2414: Buffer Overflow
A stack overflow flaw was found in libxml by parsing root XML document element DTD definition. Providing a specially-crafted XML file would lead to excessive stack growth and denial of service (application crash), when opened by a victim.
Other sources
Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML fuzzing framework.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2414?
CVE-2009-2414 has a severity level that may lead to a denial of service due to a stack overflow in libxml.
How do I fix CVE-2009-2414?
To fix CVE-2009-2414, upgrade libxml2 to version 2.6.33 or later.
What versions of libxml2 are affected by CVE-2009-2414?
CVE-2009-2414 affects libxml2 versions 2.5.10 through 2.6.32.
Can CVE-2009-2414 be exploited remotely?
Yes, CVE-2009-2414 can be exploited remotely by sending a specially-crafted XML file.
What impact does CVE-2009-2414 have on applications?
CVE-2009-2414 can cause applications that use libxml2 to crash due to excessive stack growth.