Description
Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxml2 | 2.7.3.dfsg-2.1 | — |
| Debian 13 | libxml2 | 2.7.3.dfsg-2.1 | — |
| Debian 12 | libxml2 | 2.7.3.dfsg-2.1 | — |
| Debian 5.0 | libxml2 | 2.6.32.dfsg-5+lenny1 | DSA-1859-1 |
| Debian 4.0 | libxml | 1:1.8.17-14+etch1 | DSA-1861-1 |
| Debian 4.0 | libxml2 | 2.6.27.dfsg-6+etch1 | DSA-1859-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | libxml2 +2 | 2.6.26-2.1.2.8 | RHSA-2009:1206 |
| RHEL 4 | libxml2 +2 | 2.6.16-12.7 | RHSA-2009:1206 |
| RHEL 3 | libxml +1 | 1:1.8.17-9.3 | RHSA-2009:1206 |
| RHEL 3 | libxml2 +2 | 2.5.10-15 | RHSA-2009:1206 |
Advisories 3
- RHSA-2009:1206 Red Hat Security Advisory: libxml and libxml2 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1859-1 libxml2 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1861-1 libxml - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-815-1 vendor-advisory
- FEDORA-2009-8491 vendor-advisory
- 36631 third-party-advisory
- oval:org.mitre.oval:def:9262 vdb-entry signature
- http://www.networkworld.com/columnists/2009/080509-xml-flaw.html
- https://bugzilla.redhat.com/show_bug.cgi?id=515205
- http://www.openoffice.org/security/cves/CVE-2009-2414-2416.html
- APPLE-SA-2009-11-11-1 vendor-advisory
- ADV-2009-3217 vdb-entry
- 37471 third-party-advisory
- http://support.apple.com/kb/HT4225
- ADV-2009-2420 vdb-entry
- FEDORA-2009-8580 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 36417 third-party-advisory
- http://www.cert.fi/en/reports/2009/vulnerability2009085.html
- http://www.codenomicon.com/labs/xml/
- SUSE-SR:2009:015 vendor-advisory
- http://support.apple.com/kb/HT3949
- [debian-bugs-dist] 20090810 Bug#540865: libxml2: CVE-2009-2414, CVE-2009-2416 pointer-user-after-free and stack overflow because of function recursion mailing-list
- 36010 vdb-entry
- http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- https://git.gnome.org/browse/libxml2/commit/?id=489f9671e71cc44a97b23111b3126ac8a1e21a59
- 35036 third-party-advisory
- 36338 third-party-advisory
- FEDORA-2009-8498 vendor-advisory
- oval:org.mitre.oval:def:7783 vdb-entry signature
- ADV-2009-3184 vdb-entry
- DSA-1859 vendor-advisory
- APPLE-SA-2009-11-09-1 vendor-advisory
- APPLE-SA-2010-06-21-1 vendor-advisory
- 37346 third-party-advisory
- ADV-2009-3316 vdb-entry
- http://support.apple.com/kb/HT3937
- 36207 third-party-advisory