The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Apr 12, 2012 | Dec 4, 2009 |
| Apache Httpd 2_0_x | — | — | Oct 26, 2010 | Dec 4, 2009 |
| Apache Httpd 2_2_x | — | — | Oct 26, 2010 | Dec 4, 2009 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Mar 24, 2017 | Dec 4, 2009 |
| Centos_linux | — | Upgrade expat-develUpgrade expat | Dec 1, 2016 | Dec 4, 2009 |
| Debian | — | Upgrade paraviewUpgrade coin3Upgrade xmlrpc-cUpgrade ghostscriptUpgrade simgearUpgrade gdcmUpgrade tdomUpgrade expatUpgrade tlaUpgrade audacityUpgrade udunitsUpgrade pocoUpgrade cmakeUpgrade mcabber | Jul 30, 2024 | Dec 4, 2009 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 16, 2015 |
| Freebsd | — | Upgrade apr0Upgrade expat2Upgrade libwwwUpgrade apr1 | Dec 10, 2025 | Dec 8, 2009 |
| Gentoo Linux | — | Upgrade dev-libs/expat. | Oct 30, 2017 | Dec 4, 2009 |
| Hpux | — | Update hpuxwsAPCH32.MOD_PERL2 to the latest versionUpdate hpuxwsAPACHE.MOD_JK2 to the latest versionUpdate hpuxwsAPACHE.AUTH_LDAP2 to the latest versionUpdate hpuxwsAPACHE.AUTH_LDAP to the latest versionUpdate hpuxwsAPCH32.PHP to the latest versionUpdate hpuxwsAPACHE.MOD_PERL2 to the latest versionUpdate hpuxwsAPCH32.APACHE2 to the latest versionUpdate hpuxwsAPACHE.APACHE to the latest versionUpdate hpuxwsAPCH32.MOD_JK2 to the latest versionUpdate hpuxwsAPCH32.AUTH_LDAP to the latest versionUpdate hpuxwsAPCH32.APACHE to the latest versionUpdate hpuxwsAPACHE.PHP2 to the latest versionUpdate hpuxwsAPCH32.PHP2 to the latest versionUpdate hpuxwsAPACHE.MOD_PERL to the latest versionUpdate hpuxwsAPACHE.APACHE2 to the latest versionUpdate hpuxwsAPCH32.MOD_PERL to the latest versionUpdate hpuxwsAPACHE.MOD_JK to the latest versionUpdate hpuxws22TOMCAT.TOMCAT to the latest versionUpdate hpuxwsAPCH32.AUTH_LDAP2 to the latest versionUpdate hpuxwsAPCH32.WEBPROXY to the latest versionUpdate hpuxwsAPACHE.WEBPROXY to the latest versionUpdate hpuxwsAPACHE.PHP to the latest versionUpdate hpuxwsAPCH32.MOD_JK to the latest version | Aug 11, 2017 | Dec 4, 2009 |
| Ibm Http_server | — | No fixes or workaround suggested by the vendor | Jun 22, 2018 | Dec 4, 2009 |
| Oracle_linux | — | Upgrade expatUpgrade expat-devel | Oct 16, 2024 | Dec 4, 2009 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Dec 2, 2009 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 2, 2009 |
| Suse | — | Upgrade libexpat1Upgrade python-tkUpgrade libapr-util1-0-dbd-sqlite3Upgrade python-base-x86Upgrade libexpat1-32bitUpgrade libexpat1-x86Upgrade python-x86Upgrade libpython2_6-1_0-x86Upgrade python-base-32bitUpgrade apache2Upgrade libpython2_6-1_0-32bitUpgrade apache2-preforkUpgrade pyxmlUpgrade python-idleUpgrade python-baseUpgrade libapr-util1-dbd-sqlite3Upgrade apache2-manualUpgrade libexpat-develUpgrade apache2-workerUpgrade python-32bitUpgrade python-gdbmUpgrade pythonUpgrade libapr-util1-0-dbd-pgsqlUpgrade libapr-util1Upgrade python-demoUpgrade libpython2_6-1_0Upgrade apr-util-develUpgrade apache2-develUpgrade apache2-docUpgrade python-cursesUpgrade libapr-util1-develUpgrade libapr-util1-0Upgrade expatUpgrade python-xmlUpgrade apache2-example-pagesUpgrade apache2-eventUpgrade libapr-util1-dbd-pgsqlUpgrade libapr-util1-0-dbd-mysqlUpgrade python-develUpgrade apache2-utilsUpgrade libapr-util1-dbd-mysql | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libexpat1Upgrade cmakeUpgrade lib64expat1Upgrade python2.5-minimalUpgrade python2.5Upgrade python2.4-xmlUpgrade python2.4Upgrade python2.4-minimalUpgrade libxmlrpc-core-c3Upgrade libexpat1-udeb | Nov 8, 2024 | Dec 4, 2009 |
| Vmsa 2010 0004 2 Vma And Service Console Package Expat | — | Upgrade VMware ESX 3.5 to build number 259926Upgrade VMware ESX 4.0 to build number 236512 | Aug 31, 2010 | Dec 4, 2009 |
| Vmsa 2012 0001 | — | Upgrade VMware ESXi 5.0 to build number 608089Upgrade VMware ESXi 4.0 to build number 660575Upgrade VMware ESXi 4.1 to build number 582267 | Feb 3, 2012 | Dec 4, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub