CVE-2009-3720
NoneCVSS
—
EPSS
27.9%
Published
Nov 3, 2009
CISA due date
—
The record
The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | audacity | 0 | 1.3.2-1 |
| Debian:10 | cadaver | 0 | No fix |
| Debian:10 | cmake | 0 | 2.6.0-6 |
| Debian:10 | coin3 | 0 | No fix |
| Debian:10 | expat | 0 | 2.0.1-5 |
| Debian:10 | gdcm | 0 | 2.0.14-2 |
| Debian:10 | ghostscript | 0 | 8.71~dfsg-2 |
| Debian:10 | matanza | 0 | No fix |
| Debian:10 | mcabber | 0 | 0.10.0-1 |
| Debian:10 | paraview | 0 | 3.6.2-1 |
| Debian:10 | poco | 0 | 1.3.6p1-1 |
| Debian:10 | simgear | 0 | 2.10.0-1 |
| Debian:10 | smart | 0 | 1.2-5 |
| Debian:10 | tdom | 0 | 0.8.3~20080525-1 |
| Debian:10 | tla | 0 | 1.3.5+dfsg-15 |
| Debian:10 | udunits | 0 | 2.1.8-4 |
| Debian:10 | xmlrpc-c | 0 | 1.06.27-1.1 |
| Debian:10 | xotcl | 0 | 1.6.5-1.2 |
| Debian:11 | audacity | 0 | 1.3.2-1 |
| Debian:11 | cadaver | 0 | No fix |
| Debian:11 | cmake | 0 | 2.6.0-6 |
| Debian:11 | coin3 | 0 | No fix |
| Debian:11 | expat | 0 | 2.0.1-5 |
| Debian:11 | gdcm | 0 | 2.0.14-2 |
| Debian:11 | ghostscript | 0 | 8.71~dfsg-2 |
| Debian:11 | libxmltok | 0 | No fix |
| Debian:11 | matanza | 0 | No fix |
| Debian:11 | mcabber | 0 | 0.10.0-1 |
| Debian:11 | paraview | 0 | 3.6.2-1 |
| Debian:11 | poco | 0 | 1.3.6p1-1 |
| Debian:11 | simgear | 0 | 2.10.0-1 |
| Debian:11 | tdom | 0 | 0.8.3~20080525-1 |
| Debian:11 | tla | 0 | 1.3.5+dfsg-15 |
| Debian:11 | udunits | 0 | 2.1.8-4 |
| Debian:11 | xmlrpc-c | 0 | 1.06.27-1.1 |
| Debian:11 | xotcl | 0 | 1.6.5-1.2 |
| Debian:12 | audacity | 0 | 1.3.2-1 |
| Debian:12 | cadaver | 0 | No fix |
| Debian:12 | cmake | 0 | 2.6.0-6 |
| Debian:12 | coin3 | 0 | No fix |
| Debian:12 | expat | 0 | 2.0.1-5 |
| Debian:12 | gdcm | 0 | 2.0.14-2 |
| Debian:12 | ghostscript | 0 | 8.71~dfsg-2 |
| Debian:12 | libxmltok | 0 | No fix |
| Debian:12 | matanza | 0 | No fix |
| Debian:12 | mcabber | 0 | 0.10.0-1 |
| Debian:12 | paraview | 0 | 3.6.2-1 |
| Debian:12 | poco | 0 | 1.3.6p1-1 |
| Debian:12 | simgear | 0 | 2.10.0-1 |
| Debian:12 | tdom | 0 | 0.8.3~20080525-1 |
| Debian:12 | tla | 0 | 1.3.5+dfsg-15 |
| Debian:12 | udunits | 0 | 2.1.8-4 |
| Debian:12 | xmlrpc-c | 0 | 1.06.27-1.1 |
| Debian:12 | xotcl | 0 | 1.6.5-1.2 |
| Debian:13 | audacity | 0 | 1.3.2-1 |
| Debian:13 | cadaver | 0 | No fix |
| Debian:13 | cmake | 0 | 2.6.0-6 |
| Debian:13 | coin3 | 0 | No fix |
| Debian:13 | expat | 0 | 2.0.1-5 |
| Debian:13 | gdcm | 0 | 2.0.14-2 |
| Debian:13 | ghostscript | 0 | 8.71~dfsg-2 |
| Debian:13 | matanza | 0 | No fix |
| Debian:13 | mcabber | 0 | 0.10.0-1 |
| Debian:13 | paraview | 0 | 3.6.2-1 |
| Debian:13 | poco | 0 | 1.3.6p1-1 |
| Debian:13 | simgear | 0 | 2.10.0-1 |
| Debian:13 | tdom | 0 | 0.8.3~20080525-1 |
| Debian:13 | tla | 0 | 1.3.5+dfsg-15 |
| Debian:13 | udunits | 0 | 2.1.8-4 |
| Debian:13 | xmlrpc-c | 0 | 1.06.27-1.1 |
| Debian:13 | xotcl | 0 | 1.6.5-1.2 |
| Debian:14 | audacity | 0 | 1.3.2-1 |
| Debian:14 | cadaver | 0 | No fix |
| Debian:14 | cmake | 0 | 2.6.0-6 |
| Debian:14 | coin3 | 0 | No fix |
| Debian:14 | expat | 0 | 2.0.1-5 |
| Debian:14 | gdcm | 0 | 2.0.14-2 |
| Debian:14 | ghostscript | 0 | 8.71~dfsg-2 |
| Debian:14 | matanza | 0 | No fix |
| Debian:14 | mcabber | 0 | 0.10.0-1 |
| Debian:14 | paraview | 0 | 3.6.2-1 |
| Debian:14 | poco | 0 | 1.3.6p1-1 |
| Debian:14 | simgear | 0 | 2.10.0-1 |
| Debian:14 | tdom | 0 | 0.8.3~20080525-1 |
| Debian:14 | udunits | 0 | 2.1.8-4 |
| Debian:14 | xmlrpc-c | 0 | 1.06.27-1.1 |
| Debian:14 | xotcl | 0 | 1.6.5-1.2 |
| Debian:4.0 | expat | 0 | 1.95.8-3.4+etch1 |
| Debian:4.0 | python2.4 | 0 | 2.4.4-3+etch3 |
| Debian:4.0 | python2.5 | 0 | 2.5-5+etch2 |
| Debian:5.0 | expat | 0 | 2.0.1-4+lenny1 |
| Debian:5.0 | python2.4 | 0 | 2.4.6-1+lenny1 |
| Debian:5.0 | python2.5 | 0 | 2.5.2-15+lenny1 |
| Red Hat:enterprise_linux:3::as | 4Suite | 0 | 0:0.11.1-15 |
| Red Hat:enterprise_linux:3::as | 4Suite-debuginfo | 0 | 0:0.11.1-15 |
| Red Hat:enterprise_linux:3::as | expat | 0 | 0:1.95.5-6.2 |
| Red Hat:enterprise_linux:3::as | expat-debuginfo | 0 | 0:1.95.5-6.2 |
| Red Hat:enterprise_linux:3::as | expat-devel | 0 | 0:1.95.5-6.2 |
| Red Hat:enterprise_linux:3::desktop | 4Suite | 0 | 0:0.11.1-15 |
| Red Hat:enterprise_linux:3::desktop | 4Suite-debuginfo | 0 | 0:0.11.1-15 |
| Red Hat:enterprise_linux:3::desktop | expat | 0 | 0:1.95.5-6.2 |
| Red Hat:enterprise_linux:3::desktop | expat-debuginfo | 0 | 0:1.95.5-6.2 |
| Red Hat:enterprise_linux:3::desktop | expat-devel | 0 | 0:1.95.5-6.2 |
| Red Hat:enterprise_linux:3::es | 4Suite | 0 | 0:0.11.1-15 |
| Red Hat:enterprise_linux:3::es | 4Suite-debuginfo | 0 | 0:0.11.1-15 |
| Red Hat:enterprise_linux:3::es | expat | 0 | 0:1.95.5-6.2 |
| Red Hat:enterprise_linux:3::es | expat-debuginfo | 0 | 0:1.95.5-6.2 |
| Red Hat:enterprise_linux:3::es | expat-devel | 0 | 0:1.95.5-6.2 |
| Red Hat:enterprise_linux:3::ws | 4Suite | 0 | 0:0.11.1-15 |
| Red Hat:enterprise_linux:3::ws | 4Suite-debuginfo | 0 | 0:0.11.1-15 |
| Red Hat:enterprise_linux:3::ws | expat | 0 | 0:1.95.5-6.2 |
| Red Hat:enterprise_linux:3::ws | expat-debuginfo | 0 | 0:1.95.5-6.2 |
| Red Hat:enterprise_linux:3::ws | expat-devel | 0 | 0:1.95.5-6.2 |
| Red Hat:enterprise_linux:4::as | 4Suite | 0 | 0:1.0-3.el4_8.1 |
| Red Hat:enterprise_linux:4::as | 4Suite-debuginfo | 0 | 0:1.0-3.el4_8.1 |
| Red Hat:enterprise_linux:4::as | PyXML | 0 | 0:0.8.3-6.el4_8.2 |
| Red Hat:enterprise_linux:4::as | PyXML-debuginfo | 0 | 0:0.8.3-6.el4_8.2 |
| Red Hat:enterprise_linux:4::as | expat | 0 | 0:1.95.7-4.el4_8.2 |
| Red Hat:enterprise_linux:4::as | expat-debuginfo | 0 | 0:1.95.7-4.el4_8.2 |
| Red Hat:enterprise_linux:4::as | expat-devel | 0 | 0:1.95.7-4.el4_8.2 |
| Red Hat:enterprise_linux:4::as | python | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::as | python-debuginfo | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::as | python-devel | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::as | python-docs | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::as | python-tools | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::as | tkinter | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::desktop | 4Suite | 0 | 0:1.0-3.el4_8.1 |
| Red Hat:enterprise_linux:4::desktop | 4Suite-debuginfo | 0 | 0:1.0-3.el4_8.1 |
| Red Hat:enterprise_linux:4::desktop | PyXML | 0 | 0:0.8.3-6.el4_8.2 |
| Red Hat:enterprise_linux:4::desktop | PyXML-debuginfo | 0 | 0:0.8.3-6.el4_8.2 |
| Red Hat:enterprise_linux:4::desktop | expat | 0 | 0:1.95.7-4.el4_8.2 |
| Red Hat:enterprise_linux:4::desktop | expat-debuginfo | 0 | 0:1.95.7-4.el4_8.2 |
| Red Hat:enterprise_linux:4::desktop | expat-devel | 0 | 0:1.95.7-4.el4_8.2 |
| Red Hat:enterprise_linux:4::desktop | python | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::desktop | python-debuginfo | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::desktop | python-devel | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::desktop | python-docs | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::desktop | python-tools | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::desktop | tkinter | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::es | 4Suite | 0 | 0:1.0-3.el4_8.1 |
| Red Hat:enterprise_linux:4::es | 4Suite-debuginfo | 0 | 0:1.0-3.el4_8.1 |
| Red Hat:enterprise_linux:4::es | PyXML | 0 | 0:0.8.3-6.el4_8.2 |
| Red Hat:enterprise_linux:4::es | PyXML-debuginfo | 0 | 0:0.8.3-6.el4_8.2 |
| Red Hat:enterprise_linux:4::es | expat | 0 | 0:1.95.7-4.el4_8.2 |
| Red Hat:enterprise_linux:4::es | expat-debuginfo | 0 | 0:1.95.7-4.el4_8.2 |
| Red Hat:enterprise_linux:4::es | expat-devel | 0 | 0:1.95.7-4.el4_8.2 |
| Red Hat:enterprise_linux:4::es | python | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::es | python-debuginfo | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::es | python-devel | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::es | python-docs | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::es | python-tools | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::es | tkinter | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::ws | 4Suite | 0 | 0:1.0-3.el4_8.1 |
| Red Hat:enterprise_linux:4::ws | 4Suite-debuginfo | 0 | 0:1.0-3.el4_8.1 |
| Red Hat:enterprise_linux:4::ws | PyXML | 0 | 0:0.8.3-6.el4_8.2 |
| Red Hat:enterprise_linux:4::ws | PyXML-debuginfo | 0 | 0:0.8.3-6.el4_8.2 |
| Red Hat:enterprise_linux:4::ws | expat | 0 | 0:1.95.7-4.el4_8.2 |
| Red Hat:enterprise_linux:4::ws | expat-debuginfo | 0 | 0:1.95.7-4.el4_8.2 |
| Red Hat:enterprise_linux:4::ws | expat-devel | 0 | 0:1.95.7-4.el4_8.2 |
| Red Hat:enterprise_linux:4::ws | python | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::ws | python-debuginfo | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::ws | python-devel | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::ws | python-docs | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::ws | python-tools | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:4::ws | tkinter | 0 | 0:2.3.4-14.10.el4 |
| Red Hat:enterprise_linux:5::client | PyXML | 0 | 0:0.8.4-4.el5_4.2 |
| Red Hat:enterprise_linux:5::client | PyXML-debuginfo | 0 | 0:0.8.4-4.el5_4.2 |
| Red Hat:enterprise_linux:5::client | expat | 0 | 0:1.95.8-8.3.el5_4.2 |
| Red Hat:enterprise_linux:5::client | expat-debuginfo | 0 | 0:1.95.8-8.3.el5_4.2 |
| Red Hat:enterprise_linux:5::client | expat-devel | 0 | 0:1.95.8-8.3.el5_4.2 |
| Red Hat:enterprise_linux:5::client | python | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::client | python-debuginfo | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::client | python-devel | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::client | python-libs | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::client | python-tools | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::client | tkinter | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::client_workstation | expat | 0 | 0:1.95.8-8.3.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | expat-debuginfo | 0 | 0:1.95.8-8.3.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | expat-devel | 0 | 0:1.95.8-8.3.el5_4.2 |
| Red Hat:enterprise_linux:5::client_workstation | python | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::client_workstation | python-debuginfo | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::client_workstation | python-devel | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::client_workstation | python-libs | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::client_workstation | python-tools | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::client_workstation | tkinter | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::server | PyXML | 0 | 0:0.8.4-4.el5_4.2 |
| Red Hat:enterprise_linux:5::server | PyXML-debuginfo | 0 | 0:0.8.4-4.el5_4.2 |
| Red Hat:enterprise_linux:5::server | expat | 0 | 0:1.95.8-8.3.el5_4.2 |
| Red Hat:enterprise_linux:5::server | expat-debuginfo | 0 | 0:1.95.8-8.3.el5_4.2 |
| Red Hat:enterprise_linux:5::server | expat-devel | 0 | 0:1.95.8-8.3.el5_4.2 |
| Red Hat:enterprise_linux:5::server | python | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::server | python-debuginfo | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::server | python-devel | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::server | python-libs | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::server | python-tools | 0 | 0:2.4.3-44.el5 |
| Red Hat:enterprise_linux:5::server | tkinter | 0 | 0:2.4.3-44.el5 |
| Ubuntu:16.04:LTS | cableswig | 0 | No fix |
| Ubuntu:16.04:LTS | cadaver | 0 | No fix |
| Ubuntu:16.04:LTS | insighttoolkit | 0 | No fix |
| Ubuntu:16.04:LTS | matanza | 0 | No fix |
Related vulnerabilities
- CVE-2009-3560 The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the… Also affects audacity
- CVE-2024-28757 libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use… Also affects expat
- CVE-2013-0340 expat before version 2.4.0 does not properly handle entities expansion unless an… Also affects expat
- CVE-2023-38559 A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in… Also affects ghostscript
- CVE-2021-45944 Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample… Also affects ghostscript
- CVE-2016-7976 The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute… Also affects ghostscript
- CVE-2013-5653 The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER"… Also affects ghostscript
- CVE-2008-0411 Stack-based buffer overflow in the zseticcspace function in zicc.c in Ghostscript 8.61… Also affects ghostscript