CVE-2009-3560
Medium
Description
The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.
SeverityMedium
CVSS5.0
Exploit probability—
Product
Libexpat
PublishedDec 4, 2009
First seenDec 4, 2009
How to fix
Update
- apache http_server2.0.64, 2.2.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libexpat_project libexpat | 2.0.1 | — |
| apache http_server | 2.0.35 ≤ v < 2.0.64, 2.2.0 ≤ v < 2.2.17 | 2.0.64, 2.2.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.