CVE-2009-3720
CVE-2009-3720 is a medium-severity vulnerability in Libexpat Project Libexpat with a CVSS 2.0 base score of 5.0. Its EPSS exploit-prediction score of 28% places it in the 98th percentile, indicating an elevated likelihood of exploitation.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.0)
- EPSS exploit prediction: 28% (98th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Libexpat Project Libexpat
- Published:
- Last modified:
Description
The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.
Frequently asked questions
- What is CVE-2009-3720?
- The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.
- How severe is CVE-2009-3720?
- CVE-2009-3720 has a CVSS 2.0 base score of 5.0, rated medium severity.
- Is CVE-2009-3720 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 28% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2009-3720?
- CVE-2009-3720 primarily affects Libexpat Project Libexpat. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2009-3720?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2009-3720 published?
- CVE-2009-3720 was published on 2009-11-03 and last updated on 2026-06-16.
References
- http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?r1=1.13&r2=1.15&view=patch
- http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmltok_impl.c?view=log
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051228.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051247.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051367.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051405.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051442.html
- http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
- http://lists.vmware.com/pipermail/security-announce/2010/000082.html
- http://mail.python.org/pipermail/expat-bugs/2009-January/002781.html
- http://marc.info/?l=bugtraq&m=130168502603566&w=2
- http://secunia.com/advisories/37324
- http://secunia.com/advisories/37537
- http://secunia.com/advisories/37925
- http://secunia.com/advisories/38050
- http://secunia.com/advisories/38231
- http://secunia.com/advisories/38794
- http://secunia.com/advisories/38832
- http://secunia.com/advisories/38834
- http://secunia.com/advisories/39478
- http://secunia.com/advisories/41701
- http://secunia.com/advisories/42326
- http://secunia.com/advisories/42338
- http://secunia.com/advisories/43300
- http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026
- http://sourceforge.net/tracker/index.php?func=detail&aid=1990430&group_id=10127&atid=110127
Affected products (2)
- cpe:2.3:a:libexpat_project:libexpat:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
More vulnerabilities in Libexpat Project Libexpat
- CVE-2024-45492 — Critical (CVSS 9.8): An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for…
- CVE-2024-45491 — Critical (CVSS 9.8): An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts…
- CVE-2022-25315 — Critical (CVSS 9.8): In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
- CVE-2022-25236 — Critical (CVSS 9.8): xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into…
- CVE-2022-25235 — Critical (CVSS 9.8): xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a…
- CVE-2022-23852 — Critical (CVSS 9.8): Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero…
All CVEs affecting Libexpat Project Libexpat →
Threat intelligence
Threat-intel indicators referencing this CVE:
- 49.229.102.187 (ipv4-addr)
- 41.63.62.103 (ipv4-addr)
- 221.161.235.168 (ipv4-addr)
- 203.192.232.180 (ipv4-addr)
- 177.53.215.134 (ipv4-addr)
- 149.86.233.213 (ipv4-addr)
- 141.109.168.26 (ipv4-addr)
- 141.109.168.107 (ipv4-addr)