Description
The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | audacity | 1.3.2-1 | — |
| Debian 14 | cadaver +1 | No fix yet | — |
| Debian 14 | cmake | 2.6.0-6 | — |
| Debian 14 | coin3 | 4.0.0~CMake~6f54f1602475+ds1-1 | — |
| Debian 14 | expat | 2.0.1-5 | — |
| Debian 14 | gdcm | 2.0.14-2 | — |
| Debian 14 | ghostscript | 8.71~dfsg-2 | — |
| Debian 14 | paraview | 3.6.2-1 | — |
| Debian 14 | poco | 1.3.6p1-1 | — |
| Debian 14 | simgear | 2.10.0-1 | — |
| Debian 14 | tdom | 0.8.3~20080525-1 | — |
| Debian 14 | udunits | 2.1.8-4 | — |
| Debian 14 | xmlrpc-c | 1.06.27-1.1 | — |
| Debian 14 | xotcl | 1.6.5-1.2 | — |
| Debian 13 | audacity | 1.3.2-1 | — |
| Debian 13 | cadaver +1 | No fix yet | — |
| Debian 13 | cmake | 2.6.0-6 | — |
| Debian 13 | coin3 | 4.0.0~CMake~6f54f1602475+ds1-1 | — |
| Debian 13 | expat | 2.0.1-5 | — |
| Debian 13 | gdcm | 2.0.14-2 | — |
| Debian 13 | ghostscript | 8.71~dfsg-2 | — |
| Debian 13 | mcabber | 0.10.0-1 | — |
| Debian 13 | paraview | 3.6.2-1 | — |
| Debian 13 | poco | 1.3.6p1-1 | — |
| Debian 13 | simgear | 2.10.0-1 | — |
| Debian 13 | tdom | 0.8.3~20080525-1 | — |
| Debian 13 | udunits | 2.1.8-4 | — |
| Debian 13 | xmlrpc-c | 1.06.27-1.1 | — |
| Debian 13 | xotcl | 1.6.5-1.2 | — |
| Debian 12 | audacity | 1.3.2-1 | — |
| Debian 12 | cadaver +2 | No fix yet | — |
| Debian 12 | cmake | 2.6.0-6 | — |
| Debian 12 | coin3 | 4.0.0~CMake~6f54f1602475+ds1-1 | — |
| Debian 12 | expat | 2.0.1-5 | — |
| Debian 12 | gdcm | 2.0.14-2 | — |
| Debian 12 | ghostscript | 8.71~dfsg-2 | — |
| Debian 12 | mcabber | 0.10.0-1 | — |
| Debian 12 | paraview | 3.6.2-1 | — |
| Debian 12 | poco | 1.3.6p1-1 | — |
| Debian 12 | simgear | 2.10.0-1 | — |
| Debian 12 | tdom | 0.8.3~20080525-1 | — |
| Debian 12 | tla | 1.3.5+dfsg-15 | — |
| Debian 12 | udunits | 2.1.8-4 | — |
| Debian 12 | xmlrpc-c | 1.06.27-1.1 | — |
| Debian 12 | xotcl | 1.6.5-1.2 | — |
| Debian 5.0 | expat | 2.0.1-4+lenny1 | DSA-1921-1 |
| Debian 5.0 | python2.4 | 2.4.6-1+lenny1 | DSA-1977-1 |
| Debian 5.0 | python2.5 | 2.5.2-15+lenny1 | DSA-1977-1 |
| Debian 4.0 | expat | 1.95.8-3.4+etch1 | DSA-1921-1 |
| Debian 4.0 | python2.4 | 2.4.4-3+etch3 | DSA-1977-1 |
| Debian 4.0 | python2.5 | 2.5-5+etch2 | DSA-1977-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | coin3 +4 | No fix yet | — |
| Ubuntu 26.04 LTS | coin3 +4 | No fix yet | — |
| Ubuntu 25.10 | coin3 +4 | No fix yet | — |
| Ubuntu 24.04 LTS | coin3 +2 | No fix yet | — |
| Ubuntu 22.04 LTS | coin3 +2 | No fix yet | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | coin3 +2 | No fix yet | — |
| Ubuntu 18.04 LTS | cadaver +1 | No fix yet | — |
| Ubuntu 16.04 LTS | cadaver +1 | No fix yet | — |
| Ubuntu Pro 26.04 LTS | swish-e | No fix yet | — |
| Ubuntu Pro 24.04 LTS | swish-e | No fix yet | — |
| Ubuntu Pro 22.04 LTS | swish-e | No fix yet | — |
| Ubuntu Pro 20.04 LTS | swish-e | No fix yet | — |
| Ubuntu Pro 18.04 LTS | coin3 +1 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | coin3 +3 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | coin3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | PyXML | 0.8.4-4.el5_4.2 | RHSA-2010:0002 |
| RHEL 5 | expat +1 | 1.95.8-8.3.el5_4.2 | RHSA-2009:1625 |
| RHEL 5 | python +4 | 2.4.3-44.el5 | RHSA-2011:0492 |
| RHEL 4 | 4Suite | 1.0-3.el4_8.1 | RHSA-2009:1572 |
| RHEL 4 | PyXML | 0.8.3-6.el4_8.2 | RHSA-2010:0002 |
| RHEL 4 | expat +1 | 1.95.7-4.el4_8.2 | RHSA-2009:1625 |
| RHEL 4 | python +4 | 2.3.4-14.10.el4 | RHSA-2011:0491 |
| RHEL 3 | 4Suite | 0.11.1-15 | RHSA-2009:1572 |
| RHEL 3 | expat +1 | 1.95.5-6.2 | RHSA-2009:1625 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 | openSUSE-SU-2024:10268-1 |
| openSUSE Tumbleweed | apr-util | 1.5.4-4.4 | openSUSE-SU-2024:10568-1 |
| openSUSE Tumbleweed | expat | 2.2.0-3.1 | openSUSE-SU-2024:10077-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ogdi | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | ogdi | No fix yet | — |
Advisories 10
- RHSA-2011:0492 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:0491 Red Hat Security Advisory: python security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2009:1625 Red Hat Security Advisory: expat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0002 Red Hat Security Advisory: PyXML security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1572 Red Hat Security Advisory: 4Suite security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1921-1 expat - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1977-1 python - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10568-1 libapr-util1-1.5.4-4.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10268-1 apache2-2.4.23-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10077-1 expat-2.2.0-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- SSA:2011-041-02 vendor-advisory
- http://svn.python.org/view?view=rev&revision=74429
- MDVSA-2009:215 vendor-advisory
- FEDORA-2010-17807 vendor-advisory
- FEDORA-2009-12753 vendor-advisory
- FEDORA-2009-12690 vendor-advisory
- 38832 third-party-advisory
- RHSA-2010:0002 vendor-advisory
- MDVSA-2009:216 vendor-advisory
- USN-890-1 vendor-advisory
- http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch
- http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?view=log
- SUSE-SR:2009:018 vendor-advisory
- [oss-security] 20091022 Re: Regarding expat bug 1990430 mailing-list
- MDVSA-2009:220 vendor-advisory
- [expat-bugs] 20090117 [ expat-Bugs-1990430 ] Parser crash with specially formatted UTF-8 sequences mailing-list
- 38794 third-party-advisory
- [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates mailing-list
- oval:org.mitre.oval:def:11019 vdb-entry signature
- ADV-2010-1107 vdb-entry
- MDVSA-2009:211 vendor-advisory
- [oss-security] 20090826 Re: Re: expat bug 1990430 mailing-list
- 41701 third-party-advisory
- SUSE-SR:2010:011 vendor-advisory
- [oss-security] 20090821 expat bug 1990430 mailing-list
- 37925 third-party-advisory
- 38050 third-party-advisory
- 1023160 vdb-entry
- SUSE-SR:2010:013 vendor-advisory
- oval:org.mitre.oval:def:7112 vdb-entry signature
- https://bugzilla.redhat.com/show_bug.cgi?id=531697
- FEDORA-2010-17720 vendor-advisory
- [oss-security] 20091022 Re: Re: Regarding expat bug 1990430 mailing-list
- USN-890-6 vendor-advisory
- [oss-security] 20091026 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430] mailing-list
- FEDORA-2010-17732 vendor-advisory
- [oss-security] 20090826 Re: expat bug 1990430 mailing-list
- 42338 third-party-advisory
- https://bugs.gentoo.org/show_bug.cgi?id=280615
- FEDORA-2009-12737 vendor-advisory
- 38231 third-party-advisory
- ADV-2010-3053 vdb-entry
- [oss-security] 20091028 Re: CVE Request -- expat [was: Re: Regarding expat bug 1990430] mailing-list
- FEDORA-2010-17762 vendor-advisory
- SUSE-SR:2010:012 vendor-advisory
- MDVSA-2009:212 vendor-advisory
- MDVSA-2009:218 vendor-advisory
- 38834 third-party-advisory
- ADV-2010-3061 vdb-entry
- http://sourceforge.net/tracker/index.php?func=detail&aid=1990430&group_id=10127&atid=110127
- 39478 third-party-advisory
- SUSE-SR:2010:014 vendor-advisory
- 37537 third-party-advisory
- [oss-security] 20091022 Regarding expat bug 1990430 mailing-list
- oval:org.mitre.oval:def:12719 vdb-entry signature
- 43300 third-party-advisory
- RHSA-2011:0896 vendor-advisory
- ADV-2010-0896 vdb-entry
- 273630 vendor-advisory
- HPSBUX02645 vendor-advisory