VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Aug 6, 2009· Updated Apr 23, 2026

CVE-2009-2625

CVE-2009-2625

Description

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
xerces:xercesImplMaven
< 2.10.02.10.0

Affected products

56
  • Oracle Corporation/Jdk33 versions
    cpe:2.3:a:oracle:jdk:1.5.0:-:*:*:*:*:*:*+ 32 more
    • cpe:2.3:a:oracle:jdk:1.5.0:-:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update1:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update10:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update11:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update12:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update13:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update14:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update15:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update16:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update17:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update18:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update19:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update2:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update3:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update4:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update5:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update6:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update7:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update8:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.5.0:update9:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:update11:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:update12:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:update13:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:update14:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:update2:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:update3:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:update4:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:update5:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:update6:*:*:*:*:*:*
    • cpe:2.3:a:oracle:jdk:1.6.0:update7:*:*:*:*:*:*
  • Fedoraproject/Fedora2 versions
    cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*
    • cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*
  • OpenSUSE/openSUSE3 versions
    cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*
    • cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*
    • cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*
  • SUSE S.A./Linux Enterprise Server4 versions
    cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*
    • cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*
    • cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*
    • cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*
  • Debian/Debian Linux2 versions
    cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
  • Canonical (company)/Ubuntu Linux5 versions
    cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*
    • cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*
  • Oracle Corporation/Primavera P6 Enterprise Project Portfolio Management3 versions
    cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:6.1:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:6.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:7.0:*:*:*:*:*:*:*
  • Oracle Corporation/Primavera Web Services3 versions
    cpe:2.3:a:oracle:primavera_web_services:6.2.1:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:oracle:primavera_web_services:6.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:oracle:primavera_web_services:7.0:-:*:*:*:*:*:*
    • cpe:2.3:a:oracle:primavera_web_services:7.0:sp1:*:*:*:*:*:*
  • Apache/Xerces2 Java
    cpe:2.3:a:apache:xerces2_java:2.9.1:*:*:*:*:*:*:*

Patches

1
0bdf77af1d4f

Fixing JIRA Issue #1412: https://issues.apache.org/jira/browse/XERCESJ-1412. Resolves CVE-2009-2625 and a few other issues. We were missing checks for surrogates and well-formedness when scanning system identifiers.

https://github.com/apache/xerces2-jMichael GlavassevichJun 22, 2009via ghsa
commit
1 file changed · +8 −0
  • src/org/apache/xerces/impl/XMLScanner.java+8 −0 modified
    @@ -1027,6 +1027,14 @@ protected void scanExternalID(String[] identifiers,
                     if (XMLChar.isMarkup(c) || c == ']') {
                         fStringBuffer.append((char)fEntityScanner.scanChar());
                     }
+                    else if (XMLChar.isHighSurrogate(c)) {
+                        scanSurrogates(fStringBuffer);
+                    }
+                    else if (isInvalidLiteral(c)) {
+                        reportFatalError("InvalidCharInSystemID",
+                                new Object[] { Integer.toHexString(c) }); 
+                        fEntityScanner.scanChar();
+                    }
                 } while (fEntityScanner.scanLiteral(quote, ident) != quote);
                 fStringBuffer.append(ident);
                 ident = fStringBuffer;

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

69

News mentions

0

No linked articles in our index yet.