Ubuntu.comUB:CVE-2009-3720CVE-2009-3720
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.032 Low
EPSS
Percentile
91.1%
The updatePosition function in lib/xmltok_impl.c in libexpat in Expat
2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows
context-dependent attackers to cause a denial of service (application
crash) via an XML document with crafted UTF-8 sequences that trigger a
buffer over-read, a different vulnerability than CVE-2009-2625.
Bugs
Notes
| Author | Note |
|---|---|
| jdstrand | both this and CVE-2009-2625 refer to the same expat bug: #1990430. See http://www.openwall.com/lists/oss-security/2009/09/06/1 This CVE was later assigned to the same issue, since CVE-2009-2625 was worded as a Java vulnerability. Our USN references CVE-2009-2625 and this CVE will be ignored (for expat). jdstrand provided updates in supported releases for expat, xmlrpc-c, cmake, python-xml, python2.4, and python2.5 |
| ebarretto | this is not an issue for vnc4, for more information see: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560949 |
| ccdm94 | cmake 3.20.5 and forward uses expat 2.2.10+. |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 17.10 | noarch | expat | < 2.0.1-7ubuntu1 | UNKNOWN |
| ubuntu | 18.04 | noarch | expat | < 2.0.1-7ubuntu1 | UNKNOWN |
| ubuntu | 18.10 | noarch | expat | < 2.0.1-7ubuntu1 | UNKNOWN |
| ubuntu | 6.06 | noarch | expat | < 1.95.8-3ubuntu0.1 | UNKNOWN |
| ubuntu | 19.04 | noarch | expat | < 2.0.1-7ubuntu1 | UNKNOWN |
| ubuntu | 19.10 | noarch | expat | < 2.0.1-7ubuntu1 | UNKNOWN |
| ubuntu | 20.04 | noarch | expat | < 2.0.1-7ubuntu1 | UNKNOWN |
| ubuntu | 8.04 | noarch | expat | < 2.0.1-0ubuntu1.1 | UNKNOWN |
| ubuntu | 8.10 | noarch | expat | < 2.0.1-4ubuntu0.8.10.1 | UNKNOWN |
| ubuntu | 9.04 | noarch | expat | < 2.0.1-4ubuntu0.9.04.1 | UNKNOWN |
References
launchpad.net/bugs/cve/CVE-2009-3720
nvd.nist.gov/vuln/detail/CVE-2009-3720
security-tracker.debian.org/tracker/CVE-2009-3720
ubuntu.com/security/notices/USN-890-1
ubuntu.com/security/notices/USN-890-2
ubuntu.com/security/notices/USN-890-3
ubuntu.com/security/notices/USN-890-4
ubuntu.com/security/notices/USN-890-5
ubuntu.com/security/notices/USN-890-6
www.cve.org/CVERecord?id=CVE-2009-3720
Related
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.032 Low
EPSS
Percentile
91.1%