« Volver al listado

CVE-2009-2625

Estado: ModificadaMedia (5)—

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (9)

Apache — Xerces2 JavaCanonical — Ubuntu LinuxDebian — Debian LinuxFedoraproject — FedoraOpensuse — OpensuseOracle — JDKOracle — Primavera P6 Enterprise Project Portfolio ManagementOracle — Primavera WEB ServicesSuse — Linux Enterprise Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-2625",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-08-06T15:30:00.327",
  "references": [
    {
      "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=125787273209737&w=2",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2012-1232.html",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2012-1537.html",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/36162",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/36176",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/36180",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/36199",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/37300",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/37460",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/37671",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/37754",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/38231",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/38342",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/43300",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://secunia.com/advisories/50549",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
      "tags": [
        "Broken Link",
        "Patch"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263489-1",
      "tags": [
        "Broken Link",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-272209-1",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021506.1-1",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055&r2=787352&pathrev=787353&diff_format=h",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.cert.fi/en/reports/2009/vulnerability2009085.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.codenomicon.com/labs/xml/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.debian.org/security/2010/dsa-1984",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:108",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.networkworld.com/columnists/2009/080509-xml-flaw.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/09/06/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/10/22/9",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/10/23/6",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/10/26/3",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2009-1615.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2011-0858.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/35958",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1022680",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-890-1",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-012A.html",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/2543",
      "tags": [
        "Permissions Required"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3316",
      "tags": [
        "Permissions Required"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2011/0359",
      "tags": [
        "Permissions Required"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512921",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E",
      "source": "cret@cert.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8520",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9356",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html",
      "tags": [
        "Broken Link"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=125787273209737&w=2",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2012-1232.html",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2012-1537.html",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/36162",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/36176",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/36180",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/36199",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/37300",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/37460",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/37671",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/37754",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/38231",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/38342",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/43300",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/50549",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1",
      "tags": [
        "Broken Link",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-263489-1",
      "tags": [
        "Broken Link",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-272209-1",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021506.1-1",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055&r2=787352&pathrev=787353&diff_format=h",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.cert.fi/en/reports/2009/vulnerability2009085.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.codenomicon.com/labs/xml/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2010/dsa-1984",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:209",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:108",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.networkworld.com/columnists/2009/080509-xml-flaw.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/09/06/1",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/10/22/9",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/10/23/6",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/10/26/3",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2009-1615.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2011-0858.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/35958",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1022680",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-890-1",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-294A.html",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-012A.html",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/2543",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3316",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2011/0359",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=512921",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8520",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9356",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1199.html",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1200.html",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1201.html",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1636.html",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1637.html",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1649.html",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://rhn.redhat.com/errata/RHSA-2009-1650.html",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework."
    },
    {
      "lang": "es",
      "value": "Apache Xerces2 Java, tal como se utiliza en Sun Java Runtime Environment (JRE) en JDK y JRE v6 anterior a la actualización 15 y el JDK y JRE v5.0 antes de la actualización 20, y en otros productos, permite a atacantes remotos provocar una denegación de servicio (bucle infinito y la cuelgue de aplicación) a través de una entrada XML malformada, como lo demuestra Codenomicon XML fuzzing framework."
    }
  ],
  "lastModified": "2026-06-16T23:09:51.873",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "711BCDB5-83BC-4DBA-8097-2CD33617FD19"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5F20B3E-781F-4DC1-B939-B0EAFC515F71"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEB37E93-38EB-4AEE-A3DD-D2097C0D6852"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59DED85A-153E-40B1-9ABA-D405204E464E"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "168E67FC-32BC-4DAE-B49C-840FD721D7AA"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83A2B4A2-ED27-4C12-871B-C0F78C3478FF"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E8A5D2D-B620-449B-B599-51F5C9FC658C"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A39B469-5041-4715-B6AC-36D8777677EE"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update16:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F49DBD1F-D3F5-400B-AE2E-BC87B05A5051"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update17:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E605982-97A2-4E5E-847E-2BB8AD77910C"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update18:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "848299EC-DE52-4511-BF53-C83022935964"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update19:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD5BD598-ADBC-42EE-BF81-049D89CCA426"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64AC19E5-A20C-4D51-B465-ABCDBADF550A"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2CCCA1A-F0A1-4511-AF84-326DF406C0DA"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "81B0BEF9-25FD-48F7-83BC-BEA31BC3A1BA"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E6D8590-0A99-43E0-9256-9572112F9C8F"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F2A0870-A4D3-481B-8A37-A4DC282B0DE1"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20171515-B5A5-44D2-B7F7-21EDDE39989E"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F734AF76-4CEE-4F9D-AD6A-6BECF1F977CD"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.5.0:update9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "985B45F6-C285-4061-A656-A4C1A1FE59D9"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A420DA5-1346-446B-8D23-E1E6DDBE527E"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B8CA8719-7ABE-4279-B49E-C414794A4FE1"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC92B7EC-849F-4255-9D55-43681B8DADC4"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2ABC1045-7D3D-4A14-B994-7E60A4BB4C9C"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F3C1E65-929A-4468-8584-F086E6E59839"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42C95C1D-0C2E-4733-AB1B-65650D88995D"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "47A9F499-D1E3-41BD-AC18-E8D3D3231C12"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6E07069-D6EE-4D44-94A6-CDCA4A50E6F9"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "344FA3EA-9E25-493C-976A-211D1404B251"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D081A380-5AA4-4451-94A9-7B65810106E3"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "112E7575-A3A0-4A94-AD39-7B2325B150B8"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "708E8CEF-82EE-4D4B-ABF9-87AA4878F517"
            },
            {
              "criteria": "cpe:2.3:a:oracle:jdk:1.6.0:update7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5D9D9A7-8819-44A4-80AC-52D6B63A0C9B"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7000D33B-F3C7-43E8-8FC7-9B97AADC3E12"
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B3BB5EDB-520B-4DEF-B06E-65CA13152824"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B42AB65-443B-4655-BAEA-4EB4A43D9509"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FBF7B6A8-3DF9-46EC-A90E-6EF68C39F883"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A01C8B7E-EB19-40EA-B1D2-9AE5EA536C95"
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CD2D897-E321-4CED-92E0-11A98B52053C"
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22A79A35-05DB-4B9F-AD3E-EA6F933CF10C"
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79A35457-EAA3-4BF9-A4DA-B2E414A75A02"
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F13F07CC-739B-465C-9184-0E9D708BD4C7"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F92AB32-E7DE-43F4-B877-1F41FA162EC7"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C757774-08E7-40AA-B532-6F705C8F7639"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "454A5D17-B171-4F1F-9E0B-F18D1E5CA9FD"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7EBFE35C-E243-43D1-883D-4398D71763CC"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4747CC68-FAF4-482F-929A-9DA6C24CB663"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5D026D0-EF78-438D-BEDD-FC8571F3ACEB"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2BCB73E-27BB-4878-AD9C-90C4F20C25A0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F920C50-FE0F-4915-965A-AA58884DF7A8"
            },
            {
              "criteria": "cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:6.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "944FDBF2-1262-4B85-A7D3-537330144D22"
            },
            {
              "criteria": "cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57C2F58F-13AA-45C5-9172-8465B44CA9FB"
            },
            {
              "criteria": "cpe:2.3:a:oracle:primavera_web_services:6.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A3115EB-0671-4E0C-9B75-FACFD6D42B88"
            },
            {
              "criteria": "cpe:2.3:a:oracle:primavera_web_services:7.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F3376F25-51D0-4D84-AFC7-AD1C1BCA0191"
            },
            {
              "criteria": "cpe:2.3:a:oracle:primavera_web_services:7.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDE00C3E-BB4E-4E71-86B8-E637BCD033A7"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:xerces2_java:2.9.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC3C1085-3255-449C-AFE3-984EFAC5BCCE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}