Vulnerability Report

CVE-2009-2414

Title: Xmlsoft Libxml2 Memory Corruption

Memory Corruption

Proof Of Concept

No public PoC currently indexed for CVE-2009-2414.

CWE Category CWE-119

Published Date Aug 11, 2009

Modified Date Jun 16, 2026

Exploit Status Not Found

Score 4.3 CVSS v2.0

Exploit Probability (EPSS)

3.15%

Vulnerability Summary

CVE-2009-2414: Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML fuzzing framework.

Impacted Vendors

xmlsoft 2

Reference Links

http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html http://secunia.com/advisories/35036 http://secunia.com/advisories/36207 http://secunia.com/advisories/36338 http://secunia.com/advisories/36417 http://secunia.com/advisories/36631 http://secunia.com/advisories/37346 http://secunia.com/advisories/37471 http://support.apple.com/kb/HT3937 http://support.apple.com/kb/HT3949 http://support.apple.com/kb/HT4225 http://www.cert.fi/en/reports/2009/vulnerability2009085.html http://www.codenomicon.com/labs/xml/ http://www.debian.org/security/2009/dsa-1859 http://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg678527.html http://www.networkworld.com/columnists/2009/080509-xml-flaw.html http://www.openoffice.org/security/cves/CVE-2009-2414-2416.html http://www.securityfocus.com/archive/1/507985/100/0/threaded http://www.securityfocus.com/bid/36010 http://www.ubuntu.com/usn/USN-815-1 http://www.vmware.com/security/advisories/VMSA-2009-0016.html http://www.vupen.com/english/advisories/2009/2420 http://www.vupen.com/english/advisories/2009/3184 http://www.vupen.com/english/advisories/2009/3217 http://www.vupen.com/english/advisories/2009/3316 https://bugzilla.redhat.com/show_bug.cgi?id=515195 https://git.gnome.org/browse/libxml2/commit/?id=489f9671e71cc44a97b23111b3126ac8a1e21a59 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10129 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8639 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00537.html https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00547.html https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00642.html http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html http://secunia.com/advisories/35036 http://secunia.com/advisories/36207 http://secunia.com/advisories/36338 http://secunia.com/advisories/36417 http://secunia.com/advisories/36631 http://secunia.com/advisories/37346 http://secunia.com/advisories/37471 http://support.apple.com/kb/HT3937 http://support.apple.com/kb/HT3949 http://support.apple.com/kb/HT4225 http://www.cert.fi/en/reports/2009/vulnerability2009085.html http://www.codenomicon.com/labs/xml/ http://www.debian.org/security/2009/dsa-1859 http://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg678527.html http://www.networkworld.com/columnists/2009/080509-xml-flaw.html http://www.openoffice.org/security/cves/CVE-2009-2414-2416.html http://www.securityfocus.com/archive/1/507985/100/0/threaded http://www.securityfocus.com/bid/36010 http://www.ubuntu.com/usn/USN-815-1 http://www.vmware.com/security/advisories/VMSA-2009-0016.html http://www.vupen.com/english/advisories/2009/2420 http://www.vupen.com/english/advisories/2009/3184 http://www.vupen.com/english/advisories/2009/3217 http://www.vupen.com/english/advisories/2009/3316 https://bugzilla.redhat.com/show_bug.cgi?id=515195 https://git.gnome.org/browse/libxml2/commit/?id=489f9671e71cc44a97b23111b3126ac8a1e21a59 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10129 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8639 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00537.html https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00547.html https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00642.html

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:N/I:N/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2009-2414 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

June 16, 2026 MODIFIED

Vulnerability data updated via NVD.

April 09, 2025 MODIFIED

Vulnerability data or affected products updated.

August 11, 2009 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected Stack

No specific products linked.