CVE-2009-2625
No CVSS score yet. EPSS 30% chance of exploitation in the next 30 days. Fixed in xerces:xercesImpl 2.10.0.
XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
- EPSS
- 30% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:xerces2_java
- canonical:ubuntu_linux
- debian:debian_linux
- fedoraproject:fedora
- opensuse:opensuse
- oracle:jdk
- oracle:primavera_p6_enterprise_project_portfolio_management
- oracle:primavera_web_services
- suse:linux_enterprise_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-334p-wv2m-w3vp | Maven | xerces:xercesImpl | <2.10.0 | 2.10.0 |
References
- http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html