CVE-2009-1955
High
Description
The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Apache Apr-util
PublishedJun 8, 2009
First seenJun 8, 2009
How to fix
Update
- apache apr-util1.3.7 or later
- apple mac_os_x10.6.2 or later
- apache http_server2.2.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache apr-util | v < 1.3.7 | 1.3.7 |
| apple mac_os_x | v < 10.6.2 | 10.6.2 |
| suse linux_enterprise_server | 9 | — |
| debian debian_linux | 4.0 | — |
| canonical ubuntu_linux | 6.06, 8.04, 8.10, 9.04 | — |
| fedoraproject fedora | 9, 10, 11 | — |
| oracle http_server | No range specified | — |
| apache http_server | 2.2.0 ≤ v < 2.2.12 | 2.2.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.