Description
The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | audacity | 1.3.2-1 | — |
| Debian 14 | cadaver +1 | No fix yet | — |
| Debian 14 | cmake | 2.6.0-6 | — |
| Debian 14 | coin3 | 4.0.0~CMake~6f54f1602475+ds1-1 | — |
| Debian 14 | expat | 2.0.1-6 | — |
| Debian 14 | gdcm | 2.0.14-2 | — |
| Debian 14 | ghostscript | 8.71~dfsg-2 | — |
| Debian 14 | paraview | 3.6.2-1 | — |
| Debian 14 | poco | 1.3.6p1-1 | — |
| Debian 14 | simgear | 2.10.0-1 | — |
| Debian 14 | tdom | 0.8.3~20080525-1 | — |
| Debian 14 | udunits | 2.1.8-4 | — |
| Debian 14 | xmlrpc-c | 1.06.27-1.1 | — |
| Debian 13 | audacity | 1.3.2-1 | — |
| Debian 13 | cadaver +1 | No fix yet | — |
| Debian 13 | cmake | 2.6.0-6 | — |
| Debian 13 | coin3 | 4.0.0~CMake~6f54f1602475+ds1-1 | — |
| Debian 13 | expat | 2.0.1-6 | — |
| Debian 13 | gdcm | 2.0.14-2 | — |
| Debian 13 | ghostscript | 8.71~dfsg-2 | — |
| Debian 13 | mcabber | 0.10.0-1 | — |
| Debian 13 | paraview | 3.6.2-1 | — |
| Debian 13 | poco | 1.3.6p1-1 | — |
| Debian 13 | simgear | 2.10.0-1 | — |
| Debian 13 | tdom | 0.8.3~20080525-1 | — |
| Debian 13 | udunits | 2.1.8-4 | — |
| Debian 13 | xmlrpc-c | 1.06.27-1.1 | — |
| Debian 12 | audacity | 1.3.2-1 | — |
| Debian 12 | cadaver +2 | No fix yet | — |
| Debian 12 | cmake | 2.6.0-6 | — |
| Debian 12 | coin3 | 4.0.0~CMake~6f54f1602475+ds1-1 | — |
| Debian 12 | expat | 2.0.1-6 | — |
| Debian 12 | gdcm | 2.0.14-2 | — |
| Debian 12 | ghostscript | 8.71~dfsg-2 | — |
| Debian 12 | mcabber | 0.10.0-1 | — |
| Debian 12 | paraview | 3.6.2-1 | — |
| Debian 12 | poco | 1.3.6p1-1 | — |
| Debian 12 | simgear | 2.10.0-1 | — |
| Debian 12 | tdom | 0.8.3~20080525-1 | — |
| Debian 12 | tla | 1.3.5+dfsg-15 | — |
| Debian 12 | udunits | 2.1.8-4 | — |
| Debian 12 | xmlrpc-c | 1.06.27-1.1 | — |
| Debian 5.0 | expat | 2.0.1-4+lenny2 | DSA-1953-2, DSA-1953-1 |
| Debian 5.0 | python2.4 | 2.4.6-1+lenny1 | DSA-1977-1 |
| Debian 5.0 | python2.5 | 2.5.2-15+lenny1 | DSA-1977-1 |
| Debian 4.0 | expat | 1.95.8-3.4+etch2 | DSA-1953-2, DSA-1953-1 |
| Debian 4.0 | python2.4 | 2.4.4-3+etch3 | DSA-1977-1 |
| Debian 4.0 | python2.5 | 2.5-5+etch2 | DSA-1977-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | matanza +2 | No fix yet | — |
| Ubuntu 26.04 LTS | matanza +2 | No fix yet | — |
| Ubuntu 25.10 | matanza +2 | No fix yet | — |
| Ubuntu 24.04 LTS | matanza | No fix yet | — |
| Ubuntu 22.04 LTS | matanza | No fix yet | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | matanza | No fix yet | — |
| Ubuntu 18.04 LTS | matanza | No fix yet | — |
| Ubuntu 16.04 LTS | matanza | No fix yet | — |
| Ubuntu Pro 26.04 LTS | swish-e | No fix yet | — |
| Ubuntu Pro 24.04 LTS | swish-e | No fix yet | — |
| Ubuntu Pro 22.04 LTS | swish-e | No fix yet | — |
| Ubuntu Pro 20.04 LTS | swish-e | No fix yet | — |
| Ubuntu Pro 18.04 LTS | coin3 +1 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | coin3 +2 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | coin3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | expat +1 | 1.95.8-8.3.el5_4.2 | RHSA-2009:1625 |
| RHEL 4 | expat +1 | 1.95.7-4.el4_8.2 | RHSA-2009:1625 |
| RHEL 3 | expat +1 | 1.95.5-6.2 | RHSA-2009:1625 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 | openSUSE-SU-2024:10268-1 |
| openSUSE Tumbleweed | apr-util | 1.5.4-4.4 | openSUSE-SU-2024:11586-1, openSUSE-SU-2024:10568-1 |
| openSUSE Tumbleweed | expat | 2.2.0-3.1 | openSUSE-SU-2024:10077-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ogdi | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | ogdi | No fix yet | — |
Advisories 8
- RHSA-2009:1625 Red Hat Security Advisory: expat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1977-1 python - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1953-2 expat - regression fix Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1953-1 expat - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10568-1 libapr-util1-1.5.4-4.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10268-1 apache2-2.4.23-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10077-1 expat-2.2.0-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11586-1 apr-util-devel-1.6.1-8.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165
- SSA:2011-041-02 vendor-advisory
- FEDORA-2009-12690 vendor-advisory
- 38832 third-party-advisory
- 1023278 vdb-entry
- USN-890-1 vendor-advisory
- 38794 third-party-advisory
- [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates mailing-list
- ADV-2010-1107 vdb-entry
- DSA-1953 vendor-advisory
- 41701 third-party-advisory
- SUSE-SR:2010:011 vendor-advisory
- oval:org.mitre.oval:def:6883 vdb-entry signature
- oval:org.mitre.oval:def:12942 vdb-entry signature
- SUSE-SR:2010:013 vendor-advisory
- [expat-bugs] 20091108 [ expat-Bugs-2894085 ] expat: buffer over-read and crash in big2_toUtf8() mailing-list
- SUSE-SR:2010:001 vendor-advisory
- 37203 vdb-entry
- USN-890-6 vendor-advisory
- http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?view=log#rev1.165
- FEDORA-2009-12737 vendor-advisory
- 38231 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=533174
- SUSE-SR:2010:012 vendor-advisory
- 38834 third-party-advisory
- 39478 third-party-advisory
- FEDORA-2009-12716 vendor-advisory
- SUSE-SR:2010:014 vendor-advisory
- oval:org.mitre.oval:def:10613 vdb-entry signature
- 37537 third-party-advisory
- 43300 third-party-advisory
- RHSA-2011:0896 vendor-advisory
- ADV-2010-0896 vdb-entry
- 273630 vendor-advisory
- HPSBUX02645 vendor-advisory
- ADV-2011-0359 vdb-entry
- MDVSA-2009:316 vendor-advisory
- ADV-2010-0528 vdb-entry
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [6/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [7/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list