Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.

The Xerces-c package was vulnerable to various bugs while parsing XML.
(CVE-2009-1885)

A vulnerability has been found and corrected in xerces-c :

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in simply nested DTD structures, as demonstrated by the Codenomicon XML fuzzing framework (CVE-2009-1885).

This update provides a solution to this vulnerability.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

This update fixes :

  - Bug #515515 - CVE-2009-1885 xerces-c, xerces-c27: Stack     overflow when parsing recursive XML structures

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
41989	openSUSE 10 Security Update : Xerces-c (Xerces-c-6430)	Nessus	SuSE Local Security Checks	medium
40812	Mandriva Linux Security Advisory : xerces-c (MDVSA-2009:223-1)	Nessus	Mandriva Local Security Checks	medium
40757	Fedora 10 : xerces-c-2.8.0-5.fc10 (2009-8350)	Nessus	Fedora Local Security Checks	medium
40756	Fedora 11 : xerces-c-2.8.0-5.fc11 (2009-8345)	Nessus	Fedora Local Security Checks	medium
40755	Fedora 11 : xerces-c27-2.7.0-8.fc11 (2009-8332)	Nessus	Fedora Local Security Checks	medium
40754	Fedora 10 : xerces-c27-2.7.0-8.fc10 (2009-8305)	Nessus	Fedora Local Security Checks	medium
40649	openSUSE Security Update : Xerces-c (Xerces-c-1204)	Nessus	SuSE Local Security Checks	medium
40642	openSUSE Security Update : Xerces-c (Xerces-c-1204)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2009-1885

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium