CVE-2009-1885 Denial of service in n/a

What is CVE-2009-1885?

CVE-2009-1885 is a medium-severity denial of service vulnerability in n/a, published on 11 Aug 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.

Weakness: CWE-119

Which versions are affected by CVE-2009-1885?

It affects 1 product.

Products include Apache Xerces-C\+\+.

How do I fix CVE-2009-1885?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2009-1885 being exploited?

There is no known exploitation of CVE-2009-1885 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-12627 Null dereference in Apache Xerces C++ Critical 9.8
• CVE-2016-2099 Use after free in n/a Critical 9.8
• CVE-2023-37536 HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3 High 8.2
• CVE-2024-23807 Apache Xerces C++: Use-after-free on external DTD scan High 8.1
• CVE-2018-1311 Use after free in Apache Xerces-C High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2009-1885, GHSA-m76p-wpqx-3m7x.