NVD

Id
49217  
Name
CVE-2009-1955  
Description
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.  
Reject
 
CVSS Version
2  
CVSS Score
7.8  
Severity
High  
CVSS Base Score
7.8  
CVSS Impact Subscore
6.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:C)  
Pub Date
2017-01-07  
Published
2009-06-07  
Modified Date
2013-10-10  
Seq
2009-1955  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
249193 49217 CVE-2009-1955 APPLE-SA-2009-11-09-1  View
249194 49217 CVE-2009-1955 SUSE-SR:2010:011  View
249195 49217 CVE-2009-1955 [apr-dev] 20090602 [PATCH] prevent "billion laughs" attack against expat  View
249196 49217 CVE-2009-1955 HPSBUX02612  View
249197 49217 CVE-2009-1955 oval:org.mitre.oval:def:10270  View
249198 49217 CVE-2009-1955 oval:org.mitre.oval:def:12473  View
249199 49217 CVE-2009-1955 GLSA-200907-03  View
249200 49217 CVE-2009-1955 SSA:2009-167-02  View
249201 49217 CVE-2009-1955 http://support.apple.com/kb/HT3937  View
249202 49217 CVE-2009-1955 http://svn.apache.org/viewvc?view=rev&revision=781403  View
249203 49217 CVE-2009-1955 http://wiki.rpath.com/Advisories:rPSA-2009-0123  View
249204 49217 CVE-2009-1955 PK88342  View
249205 49217 CVE-2009-1955 PK91241  View
249206 49217 CVE-2009-1955 PK99478  View
249207 49217 CVE-2009-1955 http://www-01.ibm.com/support/docview.wss?uid=swg27014463  View
249208 49217 CVE-2009-1955 http://www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3  View
249209 49217 CVE-2009-1955 DSA-1812  View
249210 49217 CVE-2009-1955 MDVSA-2009:131  View
249211 49217 CVE-2009-1955 MDVSA-2013:150  View
249212 49217 CVE-2009-1955 8842  View
249213 49217 CVE-2009-1955 [oss-security] 20090603 CVE request: "billion laughs" attack against Apache APR  View
249214 49217 CVE-2009-1955 http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html  View
249215 49217 CVE-2009-1955 RHSA-2009:1107  View
249216 49217 CVE-2009-1955 RHSA-2009:1108  View
249217 49217 CVE-2009-1955 20090824 rPSA-2009-0123-1 apr-util  View
249218 49217 CVE-2009-1955 35253  View
249219 49217 CVE-2009-1955 USN-786-1  View
249220 49217 CVE-2009-1955 USN-787-1  View
249221 49217 CVE-2009-1955 ADV-2009-1907  View
249222 49217 CVE-2009-1955 ADV-2009-3184  View
249223 49217 CVE-2009-1955 ADV-2010-1107  View
249224 49217 CVE-2009-1955 FEDORA-2009-6014  View
249225 49217 CVE-2009-1955 FEDORA-2009-6261  View
249226 49217 CVE-2009-1955 FEDORA-2009-5969  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40838 JVNDB-2009-001844 Apache APR-util の XML パーサにおけるサービス運用妨害 (DoS) の脆弱性 Apache APR-util の apr_xml_* インターフェースにおける expat XML パーサには、多数のネストされたエンティティ参照を含む XML ドキュメントの処理に不備があるため、サービス運用妨害 (DoS) 状態となる脆弱性が存在します。 CVE-2009-1955 39386 CVE-2009-1955 49217 5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001844.html 2009-06-08 2013-04-19 View