CVE-2009-2416

medium VMware
CVSS v3 Base Score
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score
0.2%
Exploitation probability in 30 days
Top 59% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Published: August 11, 2009 (6120 days ago)
Last Modified: April 23, 2026
Vendor: VMware
Source: NVD

Description

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.

CWE

CWE-416

Affected Products

xmlsoft libxmlxmlsoft libxml2fedoraproject fedoradebian debian linuxredhat enterprise linuxcanonical ubuntu linuxgoogle chromeapple safariapple iphone osapple mac os x

References

🔗 googlechromereleases.blogspot.com 🔗 lists.apple.com 🔗 lists.apple.com 🔗 lists.apple.com 🔗 lists.opensuse.org