Unrated severityNVD Advisory· Published Aug 11, 2009· Updated Jun 16, 2026
CVE-2009-1885
CVE-2009-1885
Description
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:apache:xerces-c\+\+:2.7.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:apache:xerces-c\+\+:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:xerces-c\+\+:2.8.0:*:*:*:*:*:*:*
- (no CPE)range: 2.7.0 and 2.8.0
Patches
Vulnerability mechanics
References
15- www.vupen.com/english/advisories/2009/2196nvdPatchVendor Advisory
- bugzilla.redhat.com/show_bug.cginvdPatch
- svn.apache.org/viewvcnvdExploit
- secunia.com/advisories/36201nvdVendor Advisory
- svn.apache.org/viewvc/xerces/c/trunk/src/xercesc/validators/DTD/DTDScanner.cppnvd
- www.cert.fi/en/reports/2009/vulnerability2009085.htmlnvd
- www.codenomicon.com/labs/xml/nvd
- www.mandriva.com/security/advisoriesnvd
- www.networkworld.com/columnists/2009/080509-xml-flaw.htmlnvd
- www.securityfocus.com/bid/35986nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/52321nvd
- www.redhat.com/archives/fedora-package-announce/2009-August/msg01001.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2009-August/msg01099.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2009-August/msg01136.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2009-August/msg01150.htmlnvd
News mentions
0No linked articles in our index yet.