The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Apr 12, 2012 | Dec 4, 2009 |
| Apache Httpd 2_0_x | — | — | Oct 26, 2010 | Dec 4, 2009 |
| Apache Httpd 2_2_x | — | — | Oct 26, 2010 | Dec 4, 2009 |
| Apple Itunes | — | Upgrade Apple iTunes to the latest version | Mar 24, 2017 | Dec 4, 2009 |
| Centos_linux | — | Upgrade expat-develUpgrade expat | Dec 1, 2016 | Dec 4, 2009 |
| Debian | — | Upgrade pocoUpgrade udunitsUpgrade mcabberUpgrade tlaUpgrade cmakeUpgrade audacityUpgrade expatUpgrade gdcmUpgrade coin3Upgrade paraviewUpgrade simgearUpgrade xmlrpc-cUpgrade ghostscriptUpgrade tdom | Jul 30, 2024 | Dec 4, 2009 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 16, 2015 |
| Freebsd | — | Upgrade expat2Upgrade apr0Upgrade libwwwUpgrade apr1 | Dec 10, 2025 | Dec 8, 2009 |
| Gentoo Linux | — | Upgrade dev-libs/expat. | Oct 30, 2017 | Dec 4, 2009 |
| Hpux | — | Update hpuxwsAPCH32.WEBPROXY to the latest versionUpdate hpuxwsAPACHE.PHP to the latest versionUpdate hpuxwsAPACHE.MOD_JK to the latest versionUpdate hpuxwsAPCH32.AUTH_LDAP2 to the latest versionUpdate hpuxwsAPCH32.MOD_PERL to the latest versionUpdate hpuxwsAPACHE.WEBPROXY to the latest versionUpdate hpuxwsAPACHE.APACHE2 to the latest versionUpdate hpuxwsAPCH32.MOD_JK to the latest versionUpdate hpuxws22TOMCAT.TOMCAT to the latest versionUpdate hpuxwsAPACHE.AUTH_LDAP to the latest versionUpdate hpuxwsAPCH32.APACHE to the latest versionUpdate hpuxwsAPACHE.MOD_PERL2 to the latest versionUpdate hpuxwsAPACHE.MOD_JK2 to the latest versionUpdate hpuxwsAPACHE.APACHE to the latest versionUpdate hpuxwsAPCH32.PHP to the latest versionUpdate hpuxwsAPCH32.PHP2 to the latest versionUpdate hpuxwsAPACHE.AUTH_LDAP2 to the latest versionUpdate hpuxwsAPCH32.AUTH_LDAP to the latest versionUpdate hpuxwsAPACHE.PHP2 to the latest versionUpdate hpuxwsAPCH32.MOD_PERL2 to the latest versionUpdate hpuxwsAPCH32.APACHE2 to the latest versionUpdate hpuxwsAPACHE.MOD_PERL to the latest versionUpdate hpuxwsAPCH32.MOD_JK2 to the latest version | Aug 11, 2017 | Dec 4, 2009 |
| Ibm Http_server | — | No fixes or workaround suggested by the vendor | Jun 22, 2018 | Dec 4, 2009 |
| Oracle_linux | — | Upgrade expatUpgrade expat-devel | Oct 16, 2024 | Dec 4, 2009 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Dec 2, 2009 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 2, 2009 |
| Suse | — | Upgrade python-xmlUpgrade python-cursesUpgrade python-docUpgrade libicecore-develUpgrade libnetlib-develUpgrade expat-64bitUpgrade sap-aio-releaseUpgrade python-develUpgrade libpython2_6-1_0-64bitUpgrade python-64bitUpgrade python-base-64bitUpgrade libnetlibUpgrade expatUpgrade xmlrpc-c-develUpgrade libexpat0-64bitUpgrade xmlrpc-cUpgrade python-doc-pdfUpgrade python-base-x86Upgrade libpython2_6-1_0-32bitUpgrade python-demoUpgrade libpython2_6-1_0-x86Upgrade python-tkUpgrade libiksemel-develUpgrade python-idleUpgrade expat-32bitUpgrade python-x86Upgrade python-base-32bitUpgrade libexpat1-32bitUpgrade python-mpzUpgrade libexpat0-32bitUpgrade pythonUpgrade libiiclib-develUpgrade python-32bitUpgrade libxmlrpcUpgrade pyxmlUpgrade expat-x86Upgrade libpython2_6-1_0Upgrade libexpat0Upgrade libexpat1-64bitUpgrade libiksemelUpgrade python-gdbmUpgrade libexpat1Upgrade python-baseUpgrade libiiclibUpgrade libxmlrpc-develUpgrade libexpat-develUpgrade libicecore | Feb 17, 2015 | Dec 4, 2009 |
| Ubuntu | — | Upgrade cmakeUpgrade libexpat1Upgrade python2.5-minimalUpgrade libexpat1-udebUpgrade libxmlrpc-core-c3Upgrade python2.4Upgrade python2.4-xmlUpgrade lib64expat1Upgrade python2.5Upgrade python2.4-minimal | Nov 8, 2024 | Dec 4, 2009 |
| Vmsa 2010 0004 2 Vma And Service Console Package Expat | — | Upgrade VMware ESX 3.5 to build number 259926Upgrade VMware ESX 4.0 to build number 236512 | Aug 31, 2010 | Dec 4, 2009 |
| Vmsa 2012 0001 | — | Upgrade VMware ESXi 5.0 to build number 608089Upgrade VMware ESXi 4.0 to build number 660575Upgrade VMware ESXi 4.1 to build number 582267 | Feb 3, 2012 | Dec 4, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub