What’s Vulnerable › Vulnerabilities

CVE-2009-2416

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2009-08-11 · updated 2026-06-16
• Weakness: CWE-416

Description

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.

Affected products

• Apple Iphone Os: from 2.0 before 4.0 — fixed in 4.0
• macOS: before 10.4.11; from 10.5.0 before 10.5.8; from 10.6.0 before 10.6.2 — fixed in 10.4.11, 10.5.8, 10.6.2
• Apple Mac Os X Server: before 10.4.11; from 10.5.0 before 10.5.8; from 10.6.0 before 10.6.2 — fixed in 10.4.11, 10.5.8, 10.6.2
• Apple Safari: before 4.0.4 — fixed in 4.0.4
• Canonical Ubuntu Linux: 6.06, 8.04, 8.10, 9.04 (and their updates)
• Debian Linux: 4.0 (and their updates)
• Fedoraproject Fedora: 10, 11 (and their updates)
• Google Chrome: before 2.0.172.43 — fixed in 2.0.172.43
• Opensuse: from 10.3 through 11.1
• Red Hat Enterprise Linux: 3.0, 4.0, 5.0 (and their updates)
• Sun Openoffice.Org: from 2.0.0 before 2.4.3; from 3.0.0 before 3.1.1 — fixed in 2.4.3, 3.1.1
• SUSE Linux Enterprise: 10.0, 11.0
• SUSE Linux Enterprise Server: 9 (and their updates)
• VMware ESX: 3.0.3, 3.5, 4.0 (and their updates)
• VMware ESXi: 3.5, 4.0 (and their updates)
• VMware vCenter Server: 4.0
• VMware Vma: 4.0 (and their updates)
• xmlsoft Libxml: 1.8.17 (and their updates)
• xmlsoft libxml2: 2.5.10, 2.6.16, 2.6.26, 2.6.27, 2.6.32 (and their updates)

How to fix

Upgrade to a fixed version: Apple Iphone Os 4.0; macOS 10.4.11, 10.5.8, 10.6.2; Apple Mac Os X Server 10.4.11, 10.5.8, 10.6.2; Apple Safari 4.0.4; Google Chrome 2.0.172.43; Sun Openoffice.Org 2.4.3, 3.1.1. Check the vendor advisory for mitigations.

References

• http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html
• http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
• http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html
• http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html
• http://secunia.com/advisories/35036
• http://secunia.com/advisories/36207
• http://secunia.com/advisories/36338
• http://secunia.com/advisories/36417
• http://secunia.com/advisories/36631
• http://secunia.com/advisories/37346
• http://secunia.com/advisories/37471

Get alerted when CVE-2009-2416 or the next vulnerability affects your stack