CVE

Id
39908  
CVE No.
CVE-2009-2473  
Status
Candidate  
Description
neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.  
Phase
Assigned (20090715)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
438538 39908 CVE-2009-2473 MLIST:[neon] 20090818 CVE-2009-2473: fix for "billion laughs" attack against expat  View
438539 39908 CVE-2009-2473 URL:http://lists.manyfish.co.uk/pipermail/neon/2009-August/001045.html  View
438540 39908 CVE-2009-2473 MLIST:[neon] 20090818 neon: release 0.28.6 (SECURITY)  View
438541 39908 CVE-2009-2473 URL:http://lists.manyfish.co.uk/pipermail/neon/2009-August/001044.html  View
438542 39908 CVE-2009-2473 CONFIRM:http://support.apple.com/kb/HT4435  View
438543 39908 CVE-2009-2473 APPLE:APPLE-SA-2010-11-10-1  View
438544 39908 CVE-2009-2473 URL:http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html  View
438545 39908 CVE-2009-2473 FEDORA:FEDORA-2009-8794  View
438546 39908 CVE-2009-2473 URL:https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00924.html  View
438547 39908 CVE-2009-2473 FEDORA:FEDORA-2009-8815  View
438548 39908 CVE-2009-2473 URL:https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00945.html  View
438549 39908 CVE-2009-2473 MANDRIVA:MDVSA-2009:221  View
438550 39908 CVE-2009-2473 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2009:221  View
438551 39908 CVE-2009-2473 REDHAT:RHSA-2013:0131  View
438552 39908 CVE-2009-2473 URL:http://rhn.redhat.com/errata/RHSA-2013-0131.html  View
438553 39908 CVE-2009-2473 SUSE:SUSE-SR:2009:018  View
438554 39908 CVE-2009-2473 URL:http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html  View
438555 39908 CVE-2009-2473 OVAL:oval:org.mitre.oval:def:9461  View
438556 39908 CVE-2009-2473 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9461  View
438557 39908 CVE-2009-2473 SECUNIA:36371  View
438558 39908 CVE-2009-2473 URL:http://secunia.com/advisories/36371  View
438559 39908 CVE-2009-2473 VUPEN:ADV-2009-2341  View
438560 39908 CVE-2009-2473 URL:http://www.vupen.com/english/advisories/2009/2341  View
438561 39908 CVE-2009-2473 XF:neon-xml-dos(52633)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
40915 JVNDB-2009-001921 Mozilla Firefox 3.5 に任意のコードが実行される脆弱性 Mozilla Firefox の javascript エンジンには任意のコードが実行される脆弱性が存在します。 CVE-2009-2477 39908 6.9 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001921.html  View