CVE-2009-3720: apache http_server

Modified

AliasesRHSA-2009:1572RHSA-2010:0002UBUNTU-CVE-2009-3720+2 more

Published 03-11-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-3720 is a medium (CVSS 5.0) vulnerability in apache http_server. EPSS estimates a 27.92% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

27.92%

0%100%

High · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 7 · Related 3

DSA-1977-1 OPENSUSE-SU-2024:10077-1 OPENSUSE-SU-2024:10268-1 OPENSUSE-SU-2024:10568-1 RHSA-2009:1625 RHSA-2011:0491+1 more

Timeline

03-11-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

27.92%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

No change 0.00 pp

From 27.92% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (expat.cvs.sourceforge.net)
Maturity: unknown

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian18 products

audacity< 1.3.2-1
cadaverAll versions (No fix recorded)
cmake< 2.6.0-6
coin3< 4.0.0~CMake~6f54f1602475+ds1-1
expat< 1.95.8-3.4+etch1 | < 2.0.1-4+lenny1 | < 2.0.1-5

Show all 18

Ubuntu8 products

cableswigAll versions (No fix recorded)
cadaverAll versions (No fix recorded)
coin3All versions (No fix recorded)
insighttoolkitAll versions (No fix recorded)
matanzaAll versions (No fix recorded)

Show all 8

Redhat4 products

4Suite< 0:0.11.1-15 | < 0:1.0-3.el4_8.1
4Suite-debuginfo< 0:0.11.1-15 | < 0:1.0-3.el4_8.1
PyXML< 0:0.8.3-6.el4_8.2 | < 0:0.8.4-4.el5_4.2
PyXML-debuginfo< 0:0.8.3-6.el4_8.2 | < 0:0.8.4-4.el5_4.2

Apache1 product

http_server≥ 2.0.35, < 2.0.64 | ≥ 2.2.0, < 2.2.17

Libexpat_project1 product

libexpat2.0.1

5 vendors · 32 products

References

109 links

slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026Vendor AdvisoryX Refsource SLACKWAREMailing ListThird Party Advisory
svn.python.org/view?view=rev&revision=74429X Refsource CONFIRMPermissions RequiredThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2009:215Vendor AdvisoryX Refsource MANDRIVABroken Link
lists.fedoraproject.org/pipermail/package-announce/2010-November/051442.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-December/msg01274.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-December/msg00370.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
secunia.com/advisories/38832Third Party AdvisoryX Refsource SECUNIABroken Link
www.redhat.com/support/errata/RHSA-2010-0002.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.mandriva.com/security/advisories?name=MDVSA-2009:216Vendor AdvisoryX Refsource MANDRIVABroken Link
www.ubuntu.com/usn/USN-890-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory

Show all 100 references

expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patchX Refsource CONFIRMExploit
expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?view=logX Refsource CONFIRMMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.openwall.com/lists/oss-security/2009/10/22/9Mailing ListX Refsource MLIST
www.mandriva.com/security/advisories?name=MDVSA-2009:220Vendor AdvisoryX Refsource MANDRIVABroken Link
mail.python.org/pipermail/expat-bugs/2009-January/002781.htmlMailing ListX Refsource MLISTThird Party Advisory
secunia.com/advisories/38794Third Party AdvisoryX Refsource SECUNIABroken Link
lists.vmware.com/pipermail/security-announce/2010/000082.htmlMailing ListX Refsource MLISTBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11019VDB EntrySignatureX Refsource OVALBroken Link
www.vupen.com/english/advisories/2010/1107VDB EntryX Refsource VUPENBroken Link
www.mandriva.com/security/advisories?name=MDVSA-2009:211Vendor AdvisoryX Refsource MANDRIVAPermissions RequiredThird Party Advisory
www.openwall.com/lists/oss-security/2009/08/26/4Mailing ListX Refsource MLIST
secunia.com/advisories/41701Third Party AdvisoryX Refsource SECUNIABroken Link
lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.htmlVendor AdvisoryX Refsource SUSEThird Party AdvisoryVDB Entry
www.openwall.com/lists/oss-security/2009/08/21/2Mailing ListX Refsource MLIST
secunia.com/advisories/37925Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/38050Third Party AdvisoryX Refsource SECUNIABroken Link
www.securitytracker.com/id?1023160VDB EntryX Refsource SECTRACKThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.htmlVendor AdvisoryX Refsource SUSEThird Party AdvisoryVDB Entry
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7112VDB EntrySignatureX Refsource OVALMailing ListThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=531697X Refsource CONFIRMIssue TrackingREPORT
lists.fedoraproject.org/pipermail/package-announce/2010-November/051367.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.openwall.com/lists/oss-security/2009/10/23/2Mailing ListX Refsource MLIST
www.ubuntu.com/usn/USN-890-6Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.openwall.com/lists/oss-security/2009/10/26/3Mailing ListX Refsource MLIST
lists.fedoraproject.org/pipermail/package-announce/2010-November/051247.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2009/08/26/3Mailing ListX Refsource MLIST
secunia.com/advisories/42338Third Party AdvisoryX Refsource SECUNIABroken Link
bugs.gentoo.org/show_bug.cgi?id=280615X Refsource CONFIRMThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-December/msg00413.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
secunia.com/advisories/38231Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2010/3053VDB EntryX Refsource VUPENBroken Link
www.openwall.com/lists/oss-security/2009/10/28/3Mailing ListX Refsource MLIST
lists.fedoraproject.org/pipermail/package-announce/2010-November/051228.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.htmlVendor AdvisoryX Refsource SUSEThird Party AdvisoryVDB Entry
www.mandriva.com/security/advisories?name=MDVSA-2009:212Vendor AdvisoryX Refsource MANDRIVABroken Link
www.mandriva.com/security/advisories?name=MDVSA-2009:218Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/38834Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2010/3061VDB EntryX Refsource VUPENBroken Link
sourceforge.net/tracker/index.php?func=detail&aid=1990430&group_id=10127&atid=110127X Refsource MISCMailing ListThird Party Advisory
secunia.com/advisories/39478Third Party AdvisoryX Refsource SECUNIABroken Link
lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.htmlVendor AdvisoryX Refsource SUSEThird Party AdvisoryVDB Entry
secunia.com/advisories/37537Third Party AdvisoryX Refsource SECUNIABroken Link
www.openwall.com/lists/oss-security/2009/10/22/5Mailing ListX Refsource MLIST
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12719VDB EntrySignatureX Refsource OVALBroken Link
secunia.com/advisories/43300Third Party AdvisoryX Refsource SECUNIABroken Link
www.redhat.com/support/errata/RHSA-2011-0896.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.vupen.com/english/advisories/2010/0896VDB EntryX Refsource VUPENBroken Link
sunsolve.sun.com/search/document.do?assetkey=1-66-273630-1Vendor AdvisoryX Refsource SUNALERTBroken Link
marc.info?l=bugtraq&m=130168502603566&w=2Vendor AdvisoryX Refsource HPMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2009/08/27/6Mailing ListX Refsource MLIST
lists.fedoraproject.org/pipermail/package-announce/2010-November/051405.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
www.openwall.com/lists/oss-security/2009/09/06/1Mailing ListX Refsource MLIST
www.openwall.com/lists/oss-security/2009/10/23/6Mailing ListX Refsource MLIST
www.vupen.com/english/advisories/2011/0359VDB EntryX Refsource VUPENBroken Link
www.mandriva.com/security/advisories?name=MDVSA-2009:219Vendor AdvisoryX Refsource MANDRIVABroken Link
www.vupen.com/english/advisories/2010/3035VDB EntryX Refsource VUPENBroken Link
www.mandriva.com/security/advisories?name=MDVSA-2009:217Vendor AdvisoryX Refsource MANDRIVABroken Link
secunia.com/advisories/37324Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/42326Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2010/0528VDB EntryX Refsource VUPENBroken Link
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTThird Party Advisory
access.redhat.com/errata/RHSA-2009:1572Advisory
access.redhat.com/security/updates/classification/ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1572.jsonAdvisory
access.redhat.com/security/cve/CVE-2009-3720REPORT
www.cve.org/CVERecord?id=CVE-2009-3720AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2009-3720Advisory
access.redhat.com/errata/RHSA-2010:0002Advisory

Showing 100 of 109.