CVE-2009-2625: Denial of service in Apache Xerces2
Summary
CVE-2009-2625: Denial of service in Apache Xerces2. Affects xerces:xercesImpl versions < 2.10.0. Fixed in 2.10.0. How to fix ↓
Also tracked for
- libxerces2-java · Debian:11
The same CVE-2009-2625 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Xerces2 Java is a widely used XML parser library. It is utilized by various products, including Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20. The library provides functionality for parsing and manipulating XML documents.
Vulnerability Detail
The vulnerability, identified as CVE-2009-2625, allows remote attackers to cause a denial of service (infinite loop and application hang) by providing malformed XML input. This vulnerability was discovered and demonstrated using the Codenomicon XML fuzzing framework. The issue resides in the XMLScanner.java file of Apache Xerces2 Java.
How To Fix
Minimum fixed version
2.10.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, CVE-2009-2625 is a denial of service vulnerability in Apache Xerces2 Java, which can be triggered by providing malformed XML input. To mitigate this vulnerability, it is recommended to update the Apache Xerces2 Java library to version 2.10.0 or later. There are no known workarounds for this issue. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for xerces:xercesImpl →
FAQ
The vulnerability allows remote attackers to cause a denial of service, resulting in an infinite loop and application hang. This can lead to service disruption and unavailability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
There are no known public exploits available for this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to mitigate the risk of potential attacks.
Yes, this vulnerability can be exploited remotely by sending specially crafted malformed XML input to the affected application.
There is no evidence of active exploitation of this vulnerability reported at the time of this report. However, it is advisable to apply the necessary updates to protect against potential attacks.
Related vulnerabilities
Recent vulnerabilities recorded for xerces:xercesImpl.
