expat2 -- buffer over-read and crash

CVE reports: The big2toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service application crash via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related t...

neon: billion laughs DoS attack

neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to...

Mandrake Security Advisory MDVSA-2009:211 (expat)

The remote host is missing an update to expat announced via advisory MDVSA-2009:211. OpenVAS Vulnerability Test $Id: mdksa2009211.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:211 expat Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

Mandrake Security Advisory MDVSA-2009:214 (python-celementtree)

The remote host is missing an update to python-celementtree announced via advisory MDVSA-2009:214. OpenVAS Vulnerability Test $Id: mdksa2009214.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:214 python-celementtree Authors: Thomas Reinke Copyright:...

Mandrake Security Advisory MDVSA-2009:220 (davfs)

The remote host is missing an update to davfs announced via advisory MDVSA-2009:220. OpenVAS Vulnerability Test $Id: mdksa2009220.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:220 davfs Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

Mandrake Security Advisory MDVSA-2009:213 (wxgtk)

The remote host is missing an update to wxgtk announced via advisory MDVSA-2009:213. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandrake Security Advisory MDVSA-2009:214 (python-celementtree)

The remote host is missing an update to python-celementtree announced via advisory MDVSA-2009:214. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

Mandrake Security Advisory MDVSA-2009:220 (davfs)

The remote host is missing an update to davfs announced via advisory MDVSA-2009:220. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandrake Security Advisory MDVSA-2009:215 (audacity)

The remote host is missing an update to audacity announced via advisory MDVSA-2009:215. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandrake Security Advisory MDVSA-2009:219 (kompozer)

The remote host is missing an update to kompozer announced via advisory MDVSA-2009:219. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandrake Security Advisory MDVSA-2009:211 (expat)

The remote host is missing an update to expat announced via advisory MDVSA-2009:211. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandrake Security Advisory MDVSA-2009:218 (w3c-libwww)

The remote host is missing an update to w3c-libwww announced via advisory MDVSA-2009:218. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandrake Security Advisory MDVSA-2009:215 (audacity)

The remote host is missing an update to audacity announced via advisory MDVSA-2009:215. OpenVAS Vulnerability Test $Id: mdksa2009215.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:215 audacity Authors: Thomas Reinke Copyright: Copyright c 2009 E-Sof...

Neon XML文档解析拒绝服务漏洞

BUGTRAQ ID: 36080 CVECAN ID: CVE-2009-2473 neon是一款HTTP和WebDAV客户端库。 如果使用了expat库，neon在实体扩展期间没有正确的检测递归。当客户端应用访问恶意的DAV服务器或使用XML解析接口（nexml）解析XML文档的时候，包含有大量嵌套实体引用的特制XML文档就可能耗尽大量内存和CPU资源。 Neon Client Library 0.28.6 厂商补丁： Neon ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Mandriva Linux Security Advisory : expat (MDVSA-2009:211-1)

A vulnerability was found in xmltokimpl.c expat that with specially crafted XML could be exploited and lead to a denial of service attack. Related to CVE-2009-2625 CVE-2009-3720. This update fixes this vulnerability. Update : Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers...

Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2009:217-3)

A number of security vulnerabilities have been discovered in Mozilla Thunderbird : Security issues in thunderbird could lead to a man-in-the-middle attack via a spoofed X.509 certificate CVE-2009-2408. A vulnerability was found in xmltokimpl.c expat that with specially crafted XML could be...

Mandriva Linux Security Advisory : python (MDVSA-2009:212-1)

A vulnerability was found in xmltokimpl.c expat that with specially crafted XML could be exploited and lead to a denial of service attack. Related to CVE-2009-2625 CVE-2009-3720. This update fixes this vulnerability. Update : Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers...

CVE-2009-2473

Technical details for CVE-2009-2473 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2009-2473

neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to...

CVE-2009-2473: Undefined Security Weakness

neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to...