CVE-2009-2625

描述

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

如何修補 CVE-2009-2625

要修補 CVE-2009-2625,請將受影響套件升級到下列已修補版本。

• Debian/libxerces2-java—升級至 2.9.1-4.1 或更新版本
• Debian/libxerces2-java—升級至 2.8.1-1+etch1 或更新版本
• —升級至 2.10.0 或更新版本

CVE-2009-2625 正在被利用嗎?

中等 — EPSS 為 30.4%,可持續追蹤但非最高優先。

受影響套件(3)

• from 0, < 2.9.1-4.1
• from 0, < 2.8.1-1+etch1
• from 0, < 2.10.0

參考連結(67)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2009-2625
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2009-2625
• WEBlists.apple.com/archives/security-announce/2009/Sep/msg00000.html
• WEBlists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html