Description
XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libxerces2-java | 2.9.1-4.1 | — |
| Debian 13 | libxerces2-java | 2.9.1-4.1 | — |
| Debian 12 | libxerces2-java | 2.9.1-4.1 | — |
| Debian 5.0 | libxerces2-java | 2.9.1-2+lenny1 | DSA-1984-1 |
| Debian 4.0 | libxerces2-java | 2.8.1-1+etch1 | DSA-1984-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | xerces-j2 +6 | 2.7.1-12.6.el6_0 | RHSA-2011:0858 |
| RHEL 5 | java-1.4.2-ibm +6 | 1.4.2.13.1-1jpp.1.el5 | RHSA-2009:1551, RHSA-2009:1505 |
| RHEL 5 | java-1.5.0-ibm +7 | 1:1.5.0.10-1jpp.4.el5 | RHSA-2009:1236 |
| RHEL 5 | java-1.5.0-sun +5 | 1.5.0.20-1jpp.1.el5 | RHSA-2009:1199 |
| RHEL 5 | java-1.6.0-ibm +7 | 1:1.6.0.6-1jpp.3.el5 | RHSA-2009:1582 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.2.b09.el5 | RHSA-2009:1201 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.15-1jpp.1.el5 | RHSA-2009:1200 |
| RHEL 5 | xerces-j2 +6 | 2.7.1-7jpp.2.el5_4.2 | RHSA-2009:1615 |
| RHEL 4 | java-1.4.2-ibm +6 | 1.4.2.13.1-1jpp.1.el4 | RHSA-2009:1551, RHSA-2009:1505 |
| RHEL 4 | java-1.5.0-ibm +6 | 1:1.5.0.10-1jpp.4.el4 | RHSA-2009:1236 |
| RHEL 4 | java-1.5.0-sun +5 | 1.5.0.20-1jpp.1.el4 | RHSA-2009:1199 |
| RHEL 4 | java-1.6.0-ibm +6 | 1:1.6.0.6-1jpp.3.el4 | RHSA-2009:1582 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.15-1jpp.1.el4 | RHSA-2009:1200 |
| RHEL 3 | java-1.4.2-ibm +5 | 1.4.2.13.1-1jpp.1.el3 | RHSA-2009:1505 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 3 | jasperreports-server-pro | 4.7.1-2.el6ev | RHSA-2012:1537 |
| Red Hat Network Satellite 5 | java-1.5.0-sun +1 | 1.5.0.22-1jpp.1.el4 | RHSA-2009:1662 |
| Red Hat Network Satellite 5 | java-1.6.0-ibm +1 | 1:1.6.0.7-1jpp.2.el5 | RHSA-2010:0043 |
| Red Hat JBoss EAP 4 | glassfish-javamail | 1.4.2-0jpp.ep1.5.el4 | RHSA-2009:1637, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | glassfish-jaxb +1 | 2.1.4-1.12.patch03.ep1.el4 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | glassfish-jsf | 1.2_13-2.1.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | hibernate3 +1 | 1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | hibernate3-annotations +1 | 3.3.1-1.11.GA_CP02.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | hibernate3-entitymanager +1 | 3.3.2-2.5.GA_CP01.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jacorb | 2.3.0-1jpp.ep1.9.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jakarta-commons-logging-jboss | 1.1-9.ep1.el4 | RHSA-2009:1637, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jboss-aop | 1.5.5-3.CP04.2.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jboss-common | 1.2.1-0jpp.ep1.3.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jboss-messaging | 1.4.0-3.SP3_CP09.4.ep1.el4 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jboss-remoting | 2.2.3-3.SP1.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jboss-seam +1 | 1.2.1-1.ep1.14.el5 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jboss-seam2 +1 | 2.0.2.FP-1.ep1.18.el5 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jbossas +2 | 4.2.0-5.GA_CP08.5.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jbossas-4.3.0.GA_CP07-bin | 4.3.0-6.GA_CP07.4.ep1.el4 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jbossts | 1:4.2.3-1.SP5_CP08.1jpp.ep1.1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jbossweb | 2.0.0-6.CP12.0jpp.ep1.2.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jbossws +1 | 2.0.1-4.SP2_CP07.2.ep1.el4 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jbossws-common | 1.0.0-2.GA_CP05.1.ep1.el4 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jbossws-framework | 2.0.1-1.GA_CP05.1.ep1.el4 | RHSA-2009:1649, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | jcommon | 1.0.16-1.1.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jfreechart | 1.0.13-2.3.1.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | jgroups | 1:2.4.7-1.ep1.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | quartz | 1.5.2-1jpp.patch01.ep1.4.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | rh-eap-docs +1 | 4.2.0-6.GA_CP08.ep1.3.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
| Red Hat JBoss EAP 4 | xerces-j2 | 2.7.1-9jpp.4.patch_02.1.ep1.el4 | RHSA-2009:1637, RHSA-2009:1636 |
| Red Hat JBoss EAP 4 | xml-security | 1.3.0-1.3.patch01.ep1.2.el4 | RHSA-2009:1650, RHSA-2009:1649, RHSA-2009:1637 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | expat | 2.2.0-3.1 | openSUSE-SU-2024:10077-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | xerces:xercesImpl | < 2.10.0 | 2.10.0 | GHSA-334p-wv2m-w3vp |
Advisories 21
- RHSA-2012:1537 Red Hat Security Advisory: jasperreports-server-pro security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:0858 Red Hat Security Advisory: xerces-j2 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0043 Red Hat Security Advisory: Red Hat Network Satellite Server IBM Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1662 Red Hat Security Advisory: Red Hat Network Satellite Server Sun Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1650 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP08 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1649 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP07 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1637 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.2.0.CP08 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1615 Red Hat Security Advisory: xerces-j2 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1636 Red Hat Security Advisory: JBoss Enterprise Application Platform 4.3.0.CP07 update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1582 Red Hat Security Advisory: java-1.6.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1551 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1505 Red Hat Security Advisory: java-1.4.2-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1236 Red Hat Security Advisory: java-1.5.0-ibm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1201 Red Hat Security Advisory: java-1.6.0-openjdk security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1200 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1199 Red Hat Security Advisory: java-1.5.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-1984-1 libxerces2-java - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10077-1 expat-2.2.0-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2022-1738 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2025
- WID-SEC-2024-0068 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
References
- SSA:2011-041-02 vendor-advisory
- RHSA-2009:1200 vendor-advisory
- RHSA-2009:1199 vendor-advisory
- http://www.networkworld.com/columnists/2009/080509-xml-flaw.html
- USN-890-1 vendor-advisory
- 36162 third-party-advisory
- ADV-2009-2543 vdb-entry
- DSA-1984 vendor-advisory
- [oss-security] 20091022 Re: Regarding expat bug 1990430 mailing-list
- 1021506 vendor-advisory
- 37460 third-party-advisory
- RHSA-2009:1615 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- HPSBUX02476 vendor-advisory
- 37754 third-party-advisory
- RHSA-2009:1637 vendor-advisory
- http://www.cert.fi/en/reports/2009/vulnerability2009085.html
- http://www.codenomicon.com/labs/xml/
- 36199 third-party-advisory
- RHSA-2012:1537 vendor-advisory
- SUSE-SR:2010:013 vendor-advisory
- MDVSA-2009:209 vendor-advisory
- FEDORA-2009-8329 vendor-advisory
- RHSA-2011:0858 vendor-advisory
- 1022680 vdb-entry
- 37671 third-party-advisory
- 38342 third-party-advisory
- RHSA-2009:1636 vendor-advisory
- 35958 vdb-entry
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- RHSA-2009:1649 vendor-advisory
- [oss-security] 20091026 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430] mailing-list
- TA09-294A third-party-advisory
- 50549 third-party-advisory
- oval:org.mitre.oval:def:8520 vdb-entry signature
- 36180 third-party-advisory
- 38231 third-party-advisory
- 272209 vendor-advisory
- MDVSA-2011:108 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2010-084891.html
- http://www.oracle.com/technetwork/topics/security/cpuoct2009-096303.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-125136-16-1
- 36176 third-party-advisory
- FEDORA-2009-8337 vendor-advisory
- 43300 third-party-advisory
- oval:org.mitre.oval:def:9356 vdb-entry signature
- TA10-012A third-party-advisory
- SUSE-SR:2009:016 vendor-advisory
- RHSA-2012:1232 vendor-advisory
- 263489 vendor-advisory
- http://svn.apache.org/viewvc/xerces/java/trunk/src/org/apache/xerces/impl/XMLScanner.java?r1=572055&r2=787352&pathrev=787353&diff_format=h
- 37300 third-party-advisory
- APPLE-SA-2009-09-03-1 vendor-advisory
- SUSE-SA:2009:053 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=512921
- RHSA-2009:1201 vendor-advisory
- SUSE-SR:2009:017 vendor-advisory
- [oss-security] 20090906 Re: Re: expat bug 1990430 mailing-list
- [oss-security] 20091023 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430] mailing-list
- ADV-2011-0359 vdb-entry