VDB
CISA-2009-2416
CISA-2009-2416
PUBLISHED
CVSS 6.5 MEDIUM
Reported by redhat · Published August 11, 2009
Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| n/a | n/a | n/a, n/a |
Timeline
- Aug 11, 2009 CVE Published
- Jan 21, 2025 CVE Updated
- Mar 17, 2026 Distribution Patch
- Mar 17, 2026 Distribution Patch
- Mar 17, 2026 Security Advisory
- Mar 17, 2026 Security Advisory
References
- USN-815-1 vendor-advisoryx_refsource_UBUNTU
- FEDORA-2009-8491 vendor-advisoryx_refsource_FEDORA
- 36631 third-party-advisoryx_refsource_SECUNIA
- oval:org.mitre.oval:def:9262 vdb-entrysignaturex_refsource_OVAL
- x_refsource_MISC
- x_refsource_CONFIRM
- x_refsource_CONFIRM
- APPLE-SA-2009-11-11-1 vendor-advisoryx_refsource_APPLE
- ADV-2009-3217 vdb-entryx_refsource_VUPEN
- 37471 third-party-advisoryx_refsource_SECUNIA
- x_refsource_CONFIRM
- ADV-2009-2420 vdb-entryx_refsource_VUPEN
- FEDORA-2009-8580 vendor-advisoryx_refsource_FEDORA
- x_refsource_CONFIRM
- 36417 third-party-advisoryx_refsource_SECUNIA
- x_refsource_MISC
- x_refsource_MISC
- SUSE-SR:2009:015 vendor-advisoryx_refsource_SUSE
- x_refsource_CONFIRM
- [debian-bugs-dist] 20090810 Bug#540865: libxml2: CVE-2009-2414, CVE-2009-2416 pointer-user-after-free and stack overflow because of function recursion mailing-listx_refsource_MLIST
…and 16 more