CVE-2009-3720 - Secunia

Blog

Careers

Secunia SmallBusiness

Products

Solutions

Customers

Partner

Resources

Company

Careers

Community

CVE Reference: CVE-2009-3720
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2009-3720

Description: The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.

CVE Status: Candidate

References: UBUNTU http://www.ubuntu.com/usn/USN-890-6 http://www.ubuntu.com/usn/USN-890-1 SUSE http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html SUNALERT http://sunsolve.sun.com/search/document.do?assetkey=1-66-273630-1 ST 1023160 SLACKWARE http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026 SAID Secunia Advisory: SA38832 Secunia Advisory: SA38794 Secunia Advisory: SA38231 Secunia Advisory: SA37537 Secunia Advisory: SA37925 Secunia Advisory: SA37324 Secunia Advisory: SA38834 Secunia Advisory: SA39478 Secunia Advisory: SA38050 Secunia Advisory: SA41701 Secunia Advisory: SA43300 Secunia Advisory: SA42326 Secunia Advisory: SA42338 REDHAT http://www.redhat.com/support/errata/RHSA-2010-0002.html http://www.redhat.com/support/errata/RHSA-2011-0896.html OVAL http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12719 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7112 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11019 MLIST http://lists.vmware.com/pipermail/security-announce/2010/000082.html http://www.openwall.com/lists/oss-security/2009/10/28/3 http://www.openwall.com/lists/oss-security/2009/10/22/5 http://www.openwall.com/lists/oss-security/2009/10/23/6 http://www.openwall.com/lists/oss-security/2009/10/26/3 http://www.openwall.com/lists/oss-security/2009/10/22/9 http://www.openwall.com/lists/oss-security/2009/09/06/1 http://www.openwall.com/lists/oss-security/2009/10/23/2 http://www.openwall.com/lists/oss-security/2009/08/26/3 http://www.openwall.com/lists/oss-security/2009/08/27/6 http://www.openwall.com/lists/oss-security/2009/08/26/4 http://www.openwall.com/lists/oss-security/2009/08/21/2 http://mail.python.org/pipermail/expat-bugs/2009-January/002781.html MISC http://sourceforge.net/tracker/index.php?func=detail&aid=1990430&group_id=10127&atid=110127 MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2009:219 http://www.mandriva.com/security/advisories?name=MDVSA-2009:218 http://www.mandriva.com/security/advisories?name=MDVSA-2009:220 http://www.mandriva.com/security/advisories?name=MDVSA-2009:217 http://www.mandriva.com/security/advisories?name=MDVSA-2009:216 http://www.mandriva.com/security/advisories?name=MDVSA-2009:215 http://www.mandriva.com/security/advisories?name=MDVSA-2009:212 http://www.mandriva.com/security/advisories?name=MDVSA-2009:211 FEDORA http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051405.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051442.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051228.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051247.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051367.html CONFIRM http://svn.python.org/view?view=rev&revision=74429 http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?view=log http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch

Return to the previous page.

Products

Solutions

Customers

Partner

Resources

Company

Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)

Industry
Compliance
Technology
Integration

Customers
Testimonials

VARS
MSSP
Technology Partners
References

Factsheets
Reports
Webinars
Events

About us
Careers
Memberships
Newsroom

© 2002-2013 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability