CVE Feed

    Dashboard / CVE / CVE-2009-2625

    CVE-2009-2625

    XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

    Published:Aug 5, 2009
    Last Modified:Apr 23, 2026
    EPS:Aug 6, 2009
    EPSS Score:0.01246
    CVSS Score:5

    Affected Products

    Vendor
    Apache
    Product
    Xerces2 Java
    Vendor
    Canonical
    Product
    Ubuntu Linux
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Opensuse
    Product
    Opensuse
    Vendor
    Oracle
    Product
    Jdk
    Vendor
    Oracle
    Product
    Primavera P6 Enterprise Project Portfolio Management
    Vendor
    Oracle
    Product
    Primavera Web Services
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Portal Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Web Framework
    Vendor
    Redhat
    Product
    Jboss Operations Network
    Vendor
    Redhat
    Product
    Network Satellite
    Vendor
    Redhat
    Product
    Rhel Extras
    Vendor
    Redhat
    Product
    Rhel Extras Sap
    Vendor
    Redhat
    Product
    Rhev Manager
    Vendor
    Suse
    Product
    Linux Enterprise Server

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    References

    http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
    http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
    http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
    http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
    http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
    http://marc.info/?l=bugtraq&m=125787273209737&w=2
    http://rhn.redhat.com/errata/RHSA-2012-1232.html
    http://rhn.redhat.com/errata/RHSA-2012-1537.html
    http://secunia.com/advisories/36162
    http://secunia.com/advisories/36176
    http://secunia.com/advisories/36180
    http://secunia.com/advisories/36199
    http://secunia.com/advisories/37300
    http://secunia.com/advisories/37460
    http://secunia.com/advisories/37671
    http://secunia.com/advisories/37754
    http://secunia.com/advisories/38231
    http://secunia.com/advisories/38342
    http://secunia.com/advisories/43300
    http://secunia.com/advisories/50549
    http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026
    http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-263489-1
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-272209-1
    http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021506.1-1
    http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055&r2=787352&pathrev=787353&diff_format=h
    http://www.cert.fi/en/reports/2009/vulnerability2009085.html
    http://www.codenomicon.com/labs/xml/
    http://www.debian.org/security/2010/dsa-1984
    http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
    http://www.mandriva.com/security/advisories?name=MDVSA-2011:108
    http://www.networkworld.com/columnists/2009/080509-xml-flaw.html
    http://www.openwall.com/lists/oss-security/2009/09/06/1
    http://www.openwall.com/lists/oss-security/2009/10/22/9
    http://www.openwall.com/lists/oss-security/2009/10/23/6
    http://www.openwall.com/lists/oss-security/2009/10/26/3
    http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
    http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
    http://www.redhat.com/support/errata/RHSA-2009-1615.html
    http://www.redhat.com/support/errata/RHSA-2011-0858.html
    http://www.securityfocus.com/archive/1/507985/100/0/threaded
    http://www.securityfocus.com/bid/35958
    http://www.securitytracker.com/id?1022680
    http://www.ubuntu.com/usn/USN-890-1
    http://www.us-cert.gov/cas/techalerts/TA09-294A.html
    http://www.us-cert.gov/cas/techalerts/TA10-012A.html
    http://www.vmware.com/security/advisories/VMSA-2009-0016.html
    http://www.vupen.com/english/advisories/2009/2543
    http://www.vupen.com/english/advisories/2009/3316
    http://www.vupen.com/english/advisories/2011/0359
    https://bugzilla.redhat.com/show_bug.cgi?id=512921
    https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8520
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9356
    https://rhn.redhat.com/errata/RHSA-2009-1199.html
    https://rhn.redhat.com/errata/RHSA-2009-1200.html
    https://rhn.redhat.com/errata/RHSA-2009-1201.html
    https://rhn.redhat.com/errata/RHSA-2009-1636.html
    https://rhn.redhat.com/errata/RHSA-2009-1637.html
    https://rhn.redhat.com/errata/RHSA-2009-1649.html
    https://rhn.redhat.com/errata/RHSA-2009-1650.html
    https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
    https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html
    http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
    http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
    http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
    http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
    http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
    http://marc.info/?l=bugtraq&m=125787273209737&w=2
    http://rhn.redhat.com/errata/RHSA-2012-1232.html
    http://rhn.redhat.com/errata/RHSA-2012-1537.html
    http://secunia.com/advisories/36162
    http://secunia.com/advisories/36176
    http://secunia.com/advisories/36180
    http://secunia.com/advisories/36199
    http://secunia.com/advisories/37300
    http://secunia.com/advisories/37460
    http://secunia.com/advisories/37671
    http://secunia.com/advisories/37754
    http://secunia.com/advisories/38231
    http://secunia.com/advisories/38342
    http://secunia.com/advisories/43300
    http://secunia.com/advisories/50549
    http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026
    http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-263489-1
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-272209-1
    http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021506.1-1
    http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055&r2=787352&pathrev=787353&diff_format=h
    http://www.cert.fi/en/reports/2009/vulnerability2009085.html
    http://www.codenomicon.com/labs/xml/
    http://www.debian.org/security/2010/dsa-1984
    http://www.mandriva.com/security/advisories?name=MDVSA-2009:209
    http://www.mandriva.com/security/advisories?name=MDVSA-2011:108
    http://www.networkworld.com/columnists/2009/080509-xml-flaw.html
    http://www.openwall.com/lists/oss-security/2009/09/06/1
    http://www.openwall.com/lists/oss-security/2009/10/22/9
    http://www.openwall.com/lists/oss-security/2009/10/23/6
    http://www.openwall.com/lists/oss-security/2009/10/26/3
    http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
    http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
    http://www.redhat.com/support/errata/RHSA-2009-1615.html
    http://www.redhat.com/support/errata/RHSA-2011-0858.html
    http://www.securityfocus.com/archive/1/507985/100/0/threaded
    http://www.securityfocus.com/bid/35958
    http://www.securitytracker.com/id?1022680
    http://www.ubuntu.com/usn/USN-890-1
    http://www.us-cert.gov/cas/techalerts/TA09-294A.html
    http://www.us-cert.gov/cas/techalerts/TA10-012A.html
    http://www.vmware.com/security/advisories/VMSA-2009-0016.html
    http://www.vupen.com/english/advisories/2009/2543
    http://www.vupen.com/english/advisories/2009/3316
    http://www.vupen.com/english/advisories/2011/0359
    https://bugzilla.redhat.com/show_bug.cgi?id=512921
    https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8520
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9356
    https://rhn.redhat.com/errata/RHSA-2009-1199.html
    https://rhn.redhat.com/errata/RHSA-2009-1200.html
    https://rhn.redhat.com/errata/RHSA-2009-1201.html
    https://rhn.redhat.com/errata/RHSA-2009-1636.html
    https://rhn.redhat.com/errata/RHSA-2009-1637.html
    https://rhn.redhat.com/errata/RHSA-2009-1649.html
    https://rhn.redhat.com/errata/RHSA-2009-1650.html
    https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html
    https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High