CVE-2009-3560
Published Dec 4, 2009
Last updated a year ago
Overview
- Description
- The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.
- Source
- secalert@redhat.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
- nvd@nist.gov
- CWE-119
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:libexpat_project:libexpat:2.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D7036CC4-4CF6-4D3F-B5B4-09D879A55F8E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xmltwig:xml-twig_for_perl:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0AA9A0F6-206B-4441-AFBC-1E6F00F40B9B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "838655CB-43E7-4BDA-A80C-2314C9870717",
"versionEndExcluding": "2.0.64",
"versionStartIncluding": "2.0.35"
},
{
"criteria": "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "91F58140-8FBA-4733-9E2B-493BC9E5B284",
"versionEndExcluding": "2.2.17",
"versionStartIncluding": "2.2.0"
}
],
"operator": "OR"
}
]
}
]