CVE-2009-2416

Publication date 11 August 2009

Last updated 25 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

6.5 · Medium

Score breakdown

Description

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.

Status

Package Ubuntu Release Status
libxml 10.04 LTS lucid Not in release
9.10 karmic Not in release
9.04 jaunty Not in release
8.10 intrepid Not in release
8.04 LTS hardy
Fixed in 1:1.8.17-14.1ubuntu0.1
6.06 LTS dapper Ignored end of life
libxml2 10.04 LTS lucid
Not affected
9.10 karmic
Not affected
9.04 jaunty
Fixed in 2.6.32.dfsg-5ubuntu4.2
8.10 intrepid
Fixed in 2.6.32.dfsg-4ubuntu1.2
8.04 LTS hardy
Fixed in 2.6.31.dfsg-2ubuntu1.4
6.06 LTS dapper
Fixed in 2.6.24.dfsg-1ubuntu1.5

Severity score breakdown

CVSS version: CVSS v3.0

Base score 6.5 · Medium

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-815-1
    • libxml2 vulnerabilities
    • 11 August 2009

Other references

Access our resources on patching vulnerabilities