expat2 -- buffer over-read and crash

CVE reports: The big2toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service application crash via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related t...

neon: billion laughs DoS attack

neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to...

Mandrake Security Advisory MDVSA-2009:211 (expat)

The remote host is missing an update to expat announced via advisory MDVSA-2009:211. OpenVAS Vulnerability Test $Id: mdksa2009211.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:211 expat Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

Mandrake Security Advisory MDVSA-2009:220 (davfs)

The remote host is missing an update to davfs announced via advisory MDVSA-2009:220. OpenVAS Vulnerability Test $Id: mdksa2009220.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:220 davfs Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

Mandrake Security Advisory MDVSA-2009:214 (python-celementtree)

The remote host is missing an update to python-celementtree announced via advisory MDVSA-2009:214. OpenVAS Vulnerability Test $Id: mdksa2009214.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:214 python-celementtree Authors: Thomas Reinke Copyright:...

Mandrake Security Advisory MDVSA-2009:215 (audacity)

The remote host is missing an update to audacity announced via advisory MDVSA-2009:215. OpenVAS Vulnerability Test $Id: mdksa2009215.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:215 audacity Authors: Thomas Reinke Copyright: Copyright c 2009 E-Sof...

Mandrake Security Advisory MDVSA-2009:215 (audacity)

The remote host is missing an update to audacity announced via advisory MDVSA-2009:215. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandrake Security Advisory MDVSA-2009:213 (wxgtk)

The remote host is missing an update to wxgtk announced via advisory MDVSA-2009:213. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandrake Security Advisory MDVSA-2009:214 (python-celementtree)

The remote host is missing an update to python-celementtree announced via advisory MDVSA-2009:214. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-on...

Mandrake Security Advisory MDVSA-2009:218 (w3c-libwww)

The remote host is missing an update to w3c-libwww announced via advisory MDVSA-2009:218. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandrake Security Advisory MDVSA-2009:220 (davfs)

The remote host is missing an update to davfs announced via advisory MDVSA-2009:220. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandrake Security Advisory MDVSA-2009:219 (kompozer)

The remote host is missing an update to kompozer announced via advisory MDVSA-2009:219. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Mandrake Security Advisory MDVSA-2009:211 (expat)

The remote host is missing an update to expat announced via advisory MDVSA-2009:211. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Neon XML文档解析拒绝服务漏洞

BUGTRAQ ID: 36080 CVECAN ID: CVE-2009-2473 neon是一款HTTP和WebDAV客户端库。 如果使用了expat库，neon在实体扩展期间没有正确的检测递归。当客户端应用访问恶意的DAV服务器或使用XML解析接口（nexml）解析XML文档的时候，包含有大量嵌套实体引用的特制XML文档就可能耗尽大量内存和CPU资源。 Neon Client Library 0.28.6 厂商补丁： Neon ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Mandriva Linux Security Advisory : python (MDVSA-2009:212-1)

A vulnerability was found in xmltokimpl.c expat that with specially crafted XML could be exploited and lead to a denial of service attack. Related to CVE-2009-2625 CVE-2009-3720. This update fixes this vulnerability. Update : Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers...

Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2009:217-3)

A number of security vulnerabilities have been discovered in Mozilla Thunderbird : Security issues in thunderbird could lead to a man-in-the-middle attack via a spoofed X.509 certificate CVE-2009-2408. A vulnerability was found in xmltokimpl.c expat that with specially crafted XML could be...

Mandriva Linux Security Advisory : expat (MDVSA-2009:211-1)

A vulnerability was found in xmltokimpl.c expat that with specially crafted XML could be exploited and lead to a denial of service attack. Related to CVE-2009-2625 CVE-2009-3720. This update fixes this vulnerability. Update : Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers...

CVE-2009-2473

neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service memory and CPU consumption via a crafted XML document containing a large number of nested entity references, a similar issue to...

CVE-2009-2473

Technical details for CVE-2009-2473 are not publicly available in the provided documents. Monitor for updates from official advisories.

Apache Httpd < 2.0.64 : expat DoS

A buffer over-read flaw was found in the bundled expat library. An attacker who is able to get Apache to parse an untrused XML document for example through moddav may be able to cause a crash. This crash would only be a denial of service if using the worker MPM...