DEBIAN-CVE-2009-1885

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service application crash via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrat...

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds. Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service application crash via vectors involving nested...

CVE-2009-1885

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service application crash via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrat...

CVE-2009-1885

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service application crash via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrat...

CVE-2009-1885

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service application crash via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrat...

CVE-2009-1885

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service application crash via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrat...

CVE-2009-1885

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service application crash via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrat...

CVE-2009-1885

The CVE-2009-1885 entry concerns a stack-consumption vulnerability in Apache Xerces-C++ (validator DTDScanner.cpp) affecting Xerces-C++ 2.7.0 and 2.8.0, enabling a context-dependent DoS (crash) via deeply nested DTD structures and invalid byte values, as demonstrated by the XML fuzzing framework....

DEBIAN-CVE-2009-2625

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment JRE in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service infinite loop and application hang via malformed XML input, as...

Google SketchUp Pro 7.0 (.skp file) Remote Stack Overflow PoC

No description provided by source. / Title: Google SketchUp Pro 7.0 Model File Handling Remote Stack Overflow PoC Vendor: Google Inc. http://www.google.com Product Web Page: http://www.sketchup.com http://sketchup.google.com Current Version: 7.0.10247 Summary: Google SketchUp Pro 7 is a suite of...

[SECURITY] Fedora 11 Update: xml-security-c-1.5.1-1.fc11

The xml-security-c library is a C++ implementation of the XML Digital Signa ture specification. The library makes use of the Apache XML project's Xerces-C X ML Parser and Xalan-C XSLT processor. The latter is used for processing XPath and XSLT transforms...

[SECURITY] Fedora 10 Update: xml-security-c-1.5.1-1.fc10

The xml-security-c library is a C++ implementation of the XML Digital Signa ture specification. The library makes use of the Apache XML project's Xerces-C X ML Parser and Xalan-C XSLT processor. The latter is used for processing XPath and XSLT transforms...

FreeBSD : xerces-c2 -- Attribute blowup denial-of-service (76301302-1d59-11d9-814e-0001020eed82)

Amit Klein reports about Xerces-C++ : An attacker can craft a malicious XML document, which uses XML attributes in a way that inflicts a denial of service condition on the target machine XML parser. The result of this attack is that the XML parser consumes all the CPU. %NASLMINLEVEL 70300 C Tenab...

Gentoo Security Advisory GLSA 200903-19 (xerces-c)

The remote host is missing updates announced in advisory GLSA 200903-19. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200903-19 (xerces-c)

The remote host is missing updates announced in advisory GLSA 200903-19. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

GLSA-200903-19 : Xerces-C++: Denial of Service

The remote host is affected by the vulnerability described in GLSA-200903-19 Xerces-C++: Denial of Service Frank Rast reported that the XML parser in Xerces-C++ does not correctly handle an XML schema definition with a large maxOccurs value, which triggers excessive memory consumption during the...

Xerces-C++: Denial of service

Background Xerces-C++ is a validating XML parser written in a portable subset of C++. Description Frank Rast reported that the XML parser in Xerces-C++ does not correctly handle an XML schema definition with a large maxOccurs value, which triggers excessive memory consumption during the validatio...

Outdated and vulnerable OpenSource libraries used in "Deutsche Telekom" home banking software

The "Deutsche Telekom" resp. their "T-Online" branch offer their own home banking software for Windows under ftp://software.t-online.de/pub/service/banking/banking70.exe The current release is version 7.00.0004 from 2008-03-17. This software is but insecure; it installs and uses: - the libraries...

Unfixed XSS vulnerability at www.hericom.com

Security researcher xerces, has submitted on 11/07/2008 a cross-site-scripting XSS vulnerability affecting www.hericom.com, which at the time of submission ranked 425034 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 12/07/2008. It is currentl...

CVE-2008-4482

The XML parser in Xerces-C++ before 3.0.0 allows context-dependent attackers to cause a denial of service stack consumption and crash via an XML schema definition with a large maxOccurs value, which triggers excessive memory consumption during validation of an XML file...