VYPR
Get started
← All advisories
High severity7.5NVD Advisory· Published Jun 8, 2009· Updated Apr 23, 2026

CVE-2009-1955

CVE-2009-1955

Description

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.

Affected products

13
  • Apache/Apr Util
    cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:*
    Range: <1.3.7
  • Apache/Http Server
    cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
    Range: >=2.2.0,<2.2.12
  • Oracle Corporation/Http Server
    cpe:2.3:a:oracle:http_server:-:*:*:*:*:*:*:*
  • Apple Inc./Mac Os X
    cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
    Range: <10.6.2
  • Canonical (company)/Ubuntu Linux4 versions
    cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*
  • Debian/Debian Linux
    cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • Fedoraproject/Fedora3 versions
    cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*
  • SUSE S.A./Linux Enterprise Server
    cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

60

News mentions

0

No linked articles in our index yet.