The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Apr 12, 2012 | Nov 3, 2009 |
| Apache Httpd 2_0_x | — | — | Oct 26, 2010 | Nov 3, 2009 |
| Apache Httpd 2_2_x | — | — | Oct 26, 2010 | Nov 3, 2009 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Mar 24, 2017 | Nov 3, 2009 |
| Centos_linux | — | Upgrade expat-develUpgrade python-docsUpgrade pythonUpgrade PyXMLUpgrade python-develUpgrade tkinterUpgrade python-toolsUpgrade expatUpgrade python-libsUpgrade 4Suite | Dec 1, 2016 | Nov 3, 2009 |
| Debian | — | Upgrade gdcmUpgrade audacityUpgrade cmakeUpgrade udunitsUpgrade simgearUpgrade tlaUpgrade paraviewUpgrade xmlrpc-cUpgrade ghostscriptUpgrade pocoUpgrade xotclUpgrade coin3Upgrade mcabberUpgrade tdomUpgrade expat | Jul 30, 2024 | Nov 3, 2009 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 16, 2015 |
| Freebsd | — | Upgrade apr0Upgrade expat2Upgrade linux-f10-expatUpgrade libwwwUpgrade apr1 | Dec 10, 2025 | Dec 8, 2009 |
| Gentoo Linux | — | Upgrade dev-libs/expat. | Oct 30, 2017 | Nov 3, 2009 |
| Hpux | — | Update hpuxwsAPCH32.WEBPROXY to the latest versionUpdate hpuxws22TOMCAT.TOMCAT to the latest versionUpdate hpuxwsAPCH32.MOD_PERL to the latest versionUpdate hpuxwsAPCH32.AUTH_LDAP to the latest versionUpdate hpuxwsAPCH32.PHP2 to the latest versionUpdate hpuxwsAPACHE.WEBPROXY to the latest versionUpdate hpuxwsAPCH32.MOD_PERL2 to the latest versionUpdate hpuxwsAPACHE.MOD_JK2 to the latest versionUpdate hpuxwsAPACHE.APACHE to the latest versionUpdate hpuxwsAPCH32.MOD_JK2 to the latest versionUpdate hpuxwsAPCH32.MOD_JK to the latest versionUpdate hpuxwsAPACHE.MOD_JK to the latest versionUpdate hpuxwsAPCH32.PHP to the latest versionUpdate hpuxwsAPACHE.PHP2 to the latest versionUpdate hpuxwsAPACHE.MOD_PERL2 to the latest versionUpdate hpuxwsAPCH32.APACHE2 to the latest versionUpdate hpuxwsAPACHE.PHP to the latest versionUpdate hpuxwsAPCH32.AUTH_LDAP2 to the latest versionUpdate hpuxwsAPACHE.AUTH_LDAP to the latest versionUpdate hpuxwsAPACHE.AUTH_LDAP2 to the latest versionUpdate hpuxwsAPCH32.APACHE to the latest versionUpdate hpuxwsAPACHE.MOD_PERL to the latest versionUpdate hpuxwsAPACHE.APACHE2 to the latest version | Aug 11, 2017 | Nov 3, 2009 |
| Oracle_linux | — | Upgrade pythonUpgrade tkinterUpgrade PyXMLUpgrade python-libsUpgrade python-develUpgrade python-tools | Oct 16, 2024 | Nov 3, 2009 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Jan 17, 2009 |
| Suse | — | Upgrade libexpat1-x86Upgrade libapr-util1-dbd-pgsqlUpgrade expatUpgrade libexpat-develUpgrade apache2-eventUpgrade apache2-utilsUpgrade apache2-docUpgrade libapr-util1-develUpgrade apache2-workerUpgrade libpython2_6-1_0Upgrade libexpat1-32bitUpgrade python-gdbmUpgrade libapr-util1Upgrade libpython2_6-1_0-32bitUpgrade python-cursesUpgrade python-demoUpgrade python-idleUpgrade libapr-util1-dbd-mysqlUpgrade apache2-preforkUpgrade python-develUpgrade python-32bitUpgrade apache2Upgrade python-tkUpgrade libapr-util1-dbd-sqlite3Upgrade pythonUpgrade apache2-develUpgrade apr-util-develUpgrade libexpat1Upgrade libapr-util1-0Upgrade libapr-util1-0-dbd-sqlite3Upgrade libapr-util1-0-dbd-mysqlUpgrade pyxmlUpgrade python-x86Upgrade libpython2_6-1_0-x86Upgrade libapr-util1-0-dbd-pgsqlUpgrade python-xmlUpgrade python-base-x86Upgrade apache2-manualUpgrade python-base-32bitUpgrade apache2-example-pagesUpgrade python-base | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade cmakeUpgrade python2.4Upgrade python2.5Upgrade lib64expat1Upgrade libexpat1-udebUpgrade python2.5-minimalUpgrade python2.4-xmlUpgrade libexpat1Upgrade python2.4-minimalUpgrade libxmlrpc-core-c3 | Nov 8, 2024 | Nov 3, 2009 |
| Vmsa 2010 0004 2 Vma And Service Console Package Expat | — | Upgrade VMware ESX 3.5 to build number 259926Upgrade VMware ESX 4.0 to build number 236512 | Aug 31, 2010 | Nov 3, 2009 |
| Vmsa 2012 0001 | — | Upgrade VMware ESXi 4.0 to build number 660575Upgrade VMware ESX 4.1 to build number 582267Upgrade VMware ESXi 4.1 to build number 582267Upgrade VMware ESX 4.0 to build number 660575Upgrade VMware ESXi 5.0 to build number 608089 | Feb 3, 2012 | Nov 3, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub