NetSight
IP …
medium6.5

CVE-2009-2416

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a …

Impact

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.

Affected products

VendorProductAffected versions
XmlsoftLibxml
Version 1.8.17
XmlsoftLibxml2
Versions 2.5.10, 2.6.16, 2.6.26, 2.6.27, 2.6.32
FedoraprojectFedora
Versions 10, 11
DebianDebian Linux
Version 4.0
RedhatEnterprise Linux
Versions 3.0, 4.0, 5.0
CanonicalUbuntu Linux
Versions 6.06, 8.04, 8.10, 9.04
GoogleChrome
before 2.0.172.43
AppleSafari
before 4.0.4
AppleIphone Os
from 2.0 before 4.0
AppleMac Os X
before 10.4.11
from 10.5.0 before 10.5.8
from 10.6.0 before 10.6.2
AppleMac Os X Server
before 10.4.11
from 10.5.0 before 10.5.8
from 10.6.0 before 10.6.2
OpensuseOpensuse
from 10.3 through 11.1

Weakness classification

CWE-416

References