CVEvulnerability

CVE-2009-2416

6.5 MEDIUM Published 2009-08-11 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-08-11
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-416

Description

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.

Affected configurations

• xmlsoft libxml 1.8.17 • xmlsoft libxml2 2.5.10 • xmlsoft libxml2 2.6.16 • xmlsoft libxml2 2.6.26 • xmlsoft libxml2 2.6.27 • xmlsoft libxml2 2.6.32 • fedoraproject fedora 10 • fedoraproject fedora 11 • debian debian linux 4.0 • redhat enterprise linux 3.0 • redhat enterprise linux 4.0 • redhat enterprise linux 5.0 • canonical ubuntu linux 6.06 • canonical ubuntu linux 8.04 • canonical ubuntu linux 8.10 • canonical ubuntu linux 9.04 • google chrome (< 2.0.172.43) • apple safari (< 4.0.4) • apple iphone os (>= 2.0 < 4.0) • apple mac os x (< 10.4.11) • apple mac os x (>= 10.5.0 < 10.5.8) • apple mac os x (>= 10.6.0 < 10.6.2) • apple mac os x server (< 10.4.11) • apple mac os x server (>= 10.5.0 < 10.5.8) • apple mac os x server (>= 10.6.0 < 10.6.2) • opensuse opensuse (>= 10.3 <= 11.1) • suse linux enterprise 10.0 • suse linux enterprise 11.0 • suse linux enterprise server 9 • vmware vcenter server 4.0 • vmware vma 4.0 • vmware esx 3.0.3 • vmware esx 3.5 • vmware esx 4.0 • vmware esxi 3.5 • vmware esxi 4.0 • sun openoffice.org (>= 2.0.0 < 2.4.3) • sun openoffice.org (>= 3.0.0 < 3.1.1)

Related

Weakness · CWE (1)

Referenced by CWE · observed example (1)

References