The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Apr 12, 2012 | Nov 3, 2009 |
| Apache Httpd 2_0_x | — | — | Oct 26, 2010 | Nov 3, 2009 |
| Apache Httpd 2_2_x | — | — | Oct 26, 2010 | Nov 3, 2009 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Mar 24, 2017 | Nov 3, 2009 |
| Centos_linux | — | Upgrade tkinterUpgrade expatUpgrade python-libsUpgrade python-toolsUpgrade 4SuiteUpgrade python-develUpgrade python-docsUpgrade PyXMLUpgrade expat-develUpgrade python | Dec 1, 2016 | Nov 3, 2009 |
| Debian | — | Upgrade mcabberUpgrade tdomUpgrade coin3Upgrade xotclUpgrade expatUpgrade pocoUpgrade cmakeUpgrade xmlrpc-cUpgrade paraviewUpgrade ghostscriptUpgrade tlaUpgrade udunitsUpgrade gdcmUpgrade simgearUpgrade audacity | Jul 30, 2024 | Nov 3, 2009 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 16, 2015 |
| Freebsd | — | Upgrade apr0Upgrade expat2Upgrade apr1Upgrade linux-f10-expatUpgrade libwww | Dec 10, 2025 | Dec 8, 2009 |
| Gentoo Linux | — | Upgrade dev-libs/expat. | Oct 30, 2017 | Nov 3, 2009 |
| Hpux | — | Update hpuxws22TOMCAT.TOMCAT to the latest versionUpdate hpuxwsAPCH32.MOD_PERL2 to the latest versionUpdate hpuxwsAPCH32.MOD_JK to the latest versionUpdate hpuxwsAPCH32.MOD_JK2 to the latest versionUpdate hpuxwsAPCH32.PHP2 to the latest versionUpdate hpuxwsAPCH32.AUTH_LDAP to the latest versionUpdate hpuxwsAPACHE.MOD_JK2 to the latest versionUpdate hpuxwsAPCH32.MOD_PERL to the latest versionUpdate hpuxwsAPACHE.WEBPROXY to the latest versionUpdate hpuxwsAPACHE.APACHE to the latest versionUpdate hpuxwsAPCH32.WEBPROXY to the latest versionUpdate hpuxwsAPACHE.PHP to the latest versionUpdate hpuxwsAPACHE.APACHE2 to the latest versionUpdate hpuxwsAPACHE.MOD_JK to the latest versionUpdate hpuxwsAPCH32.APACHE to the latest versionUpdate hpuxwsAPACHE.MOD_PERL2 to the latest versionUpdate hpuxwsAPCH32.AUTH_LDAP2 to the latest versionUpdate hpuxwsAPACHE.MOD_PERL to the latest versionUpdate hpuxwsAPACHE.AUTH_LDAP2 to the latest versionUpdate hpuxwsAPCH32.APACHE2 to the latest versionUpdate hpuxwsAPACHE.PHP2 to the latest versionUpdate hpuxwsAPCH32.PHP to the latest versionUpdate hpuxwsAPACHE.AUTH_LDAP to the latest version | Aug 11, 2017 | Nov 3, 2009 |
| Oracle_linux | — | Upgrade tkinterUpgrade PyXMLUpgrade pythonUpgrade python-toolsUpgrade python-develUpgrade python-libs | Oct 16, 2024 | Nov 3, 2009 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jan 17, 2009 |
| Suse | — | Upgrade libnetlib-develUpgrade libxmlrpcUpgrade expat-64bitUpgrade python-base-64bitUpgrade sap-aio-releaseUpgrade xmlrpc-cUpgrade libpython2_6-1_0-32bitUpgrade libpython2_6-1_0Upgrade python-mpzUpgrade python-64bitUpgrade python-develUpgrade libnetlibUpgrade python-32bitUpgrade python-idleUpgrade libiiclibUpgrade python-demoUpgrade libexpat1-32bitUpgrade python-docUpgrade libexpat-develUpgrade python-gdbmUpgrade python-cursesUpgrade expatUpgrade libpython2_6-1_0-x86Upgrade pythonUpgrade expat-32bitUpgrade python-xmlUpgrade libxmlrpc-develUpgrade python-base-32bitUpgrade libexpat1-64bitUpgrade python-baseUpgrade python-tkUpgrade expat-x86Upgrade libicecoreUpgrade libiksemelUpgrade libiiclib-develUpgrade python-base-x86Upgrade libexpat1Upgrade libpython2_6-1_0-64bitUpgrade pyxmlUpgrade libiksemel-develUpgrade xmlrpc-c-develUpgrade libicecore-develUpgrade python-doc-pdfUpgrade python-x86 | Feb 17, 2015 | Nov 3, 2009 |
| Ubuntu | — | Upgrade python2.4-minimalUpgrade python2.4-xmlUpgrade libexpat1Upgrade libxmlrpc-core-c3Upgrade python2.5Upgrade lib64expat1Upgrade python2.5-minimalUpgrade libexpat1-udebUpgrade cmakeUpgrade python2.4 | Nov 8, 2024 | Nov 3, 2009 |
| Vmsa 2010 0004 2 Vma And Service Console Package Expat | — | Upgrade VMware ESX 3.5 to build number 259926Upgrade VMware ESX 4.0 to build number 236512 | Aug 31, 2010 | Nov 3, 2009 |
| Vmsa 2012 0001 | — | Upgrade VMware ESXi 4.0 to build number 660575Upgrade VMware ESX 4.1 to build number 582267Upgrade VMware ESXi 4.1 to build number 582267Upgrade VMware ESXi 5.0 to build number 608089Upgrade VMware ESX 4.0 to build number 660575 | Feb 3, 2012 | Nov 3, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub