Jukka Taimisto, Tero Rontti and Rauli Kaksonen discovered that Expat did not properly process malformed XML. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service via application crash.
(CVE-2009-2625, CVE-2009-3720)

It was discovered that Expat did not properly process malformed UTF-8 sequences. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service via application crash. (CVE-2009-3560).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-890-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for the PyExpat module in Python 2.5.

Jukka Taimisto, Tero Rontti and Rauli Kaksonen discovered that Expat did not properly process malformed XML. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service via application crash.
(CVE-2009-2625, CVE-2009-3720)

It was discovered that Expat did not properly process malformed UTF-8 sequences. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service via application crash. (CVE-2009-3560).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-890-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for PyXML.

Jukka Taimisto, Tero Rontti and Rauli Kaksonen discovered that Expat did not properly process malformed XML. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service via application crash.
(CVE-2009-2625, CVE-2009-3720)

It was discovered that Expat did not properly process malformed UTF-8 sequences. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service via application crash. (CVE-2009-3560).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-890-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for CMake.

Jukka Taimisto, Tero Rontti and Rauli Kaksonen discovered that Expat did not properly process malformed XML. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service via application crash.
(CVE-2009-2625, CVE-2009-3720)

It was discovered that Expat did not properly process malformed UTF-8 sequences. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service via application crash. (CVE-2009-3560).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of python has a copy of libxmlrpc that is vulnerable to denial of service bugs that can occur while processing malformed XML input. CVE-2009-2625: CVSS v2 Base Score: 5.0 (moderate) (AV:N/AC:L/Au:N/C:N/I:N/A:P): Permissions, Privileges, and Access Control (CWE-264) CVE-2009-3720: CVSS v2 Base Score: 5.0 (MEDIUM) (AV:N/AC:L/Au:N/C:N/I:N/A:P): Insufficient Information (CWE-noinfo) CVE-2009-3560: CVSS v2 Base Score: 5.0 (MEDIUM) (AV:N/AC:L/Au:N/C:N/I:N/A:P): Buffer Errors (CWE-119)

CVE-2009-3560 The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.

CVE-2009-3720 The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.

Versions of Apache 2.2 earlier than 2.2.17 are potentially affected by multiple vulnerabilities :

  - Errors exist in the bundled expat library that may allow an attacker to crash the server when a buffer is over-read when parsing an XML document. (CVE-2009-3720 and CVE-2009-3560)

  - An error exists in the 'apr_brigade_split_line' function in the bundled APR-util library. Carefully timed bytes in requests result in gradual memory increases leading to a denial of service. (CVE-2010-1623)

Versions of Apache 2.2 earlier than 2.2.17 are potentially affected by multiple vulnerabilities :

  - Errors exist in the bundled expat library that may allow an attacker to crash the server when a buffer is over-read when parsing an XML document. (CVE-2009-3720 and CVE-2009-3560)

  - An error exists in the 'apr_brigade_split_line' function in the bundled APR-util library. Carefully timed bytes in requests result in gradual memory increases leading to a denial of service. (CVE-2010-1623)
IAVA Reference : 2012-A-0020
STIG Finding Severity : Category I

ID	Name	Product	Family	Published	Updated	Severity
44108	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : expat vulnerabilities (USN-890-1)	Nessus	Ubuntu Local Security Checks	1/21/2010	9/19/2019	medium
44115	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : python2.5 vulnerabilities (USN-890-2)	Nessus	Ubuntu Local Security Checks	1/22/2010	9/19/2019	medium
44323	Ubuntu 6.06 LTS : python-xml vulnerabilities (USN-890-4)	Nessus	Ubuntu Local Security Checks	1/27/2010	9/19/2019	medium
45549	Ubuntu 8.04 LTS / 8.10 / 9.04 : cmake vulnerabilities (USN-890-6)	Nessus	Ubuntu Local Security Checks	4/16/2010	9/19/2019	medium
46341	openSUSE Security Update : libpython2_6-1_0 (openSUSE-SU-2010:0247-1)	Nessus	SuSE Local Security Checks	5/15/2010	1/14/2021	medium
79892	F5 Networks BIG-IP : Expat vulnerabilities (K15905)	Nessus	F5 Networks Local Security Checks	12/15/2014	3/10/2021	medium
6793	Apache 2.2 < 2.2.17 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	5/7/2013	3/6/2019	medium
800577	Apache 2.2 < 2.2.17 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	5/7/2013		high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

high