CVE-2009-1885
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2...
CVE-2009-1885 is a medium vulnerability (CVSS 4.3) in Apache Xerces-c\+\+, published August 11, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.32%, the 92nd percentile. Fixed in xerces-c 3.0.1-2.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 5.32%EPSS, 92nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.0.1-2xerces-c +3 more
Description
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
Exploit likelihood
Affected products
Affected packages
What each source reports
NVD Score used
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
- Record
CVE-2009-1885- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
- Record
CVE-2009-1885- Updated
- 2026-11-02
EUVDEUVD-2009-1880No score
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
- Record
EUVD-2009-1880- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m76p-wpqx-3m7xNo score
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2...
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
- Record
GHSA-m76p-wpqx-3m7x- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVNo score
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
- Record
CVE-2009-1885- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-1885No score
Stack consumption vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 2.7.0 and 2.8.0 allows context-dependent attackers to cause a denial of service (application crash) via vectors involving nested parentheses and invalid byte values in "simply nested DTD structures," as demonstrated by the Codenomicon XML fuzzing framework.
- Record
DEBIAN-CVE-2009-1885- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10039-1No score
libxerces-c-3_1-3.1.4-1.3 on GA media
These are all security issues fixed in the libxerces-c-3_1-3.1.4-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10039-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/35986
networkworld.com/columnists/2009/080509-xml-flaw.html
cert.fi/en/reports/2009/vulnerability2009085.html
codenomicon.com/labs/xml
redhat.com/archives/fedora-package-announce/2009-August/msg01136.html
secunia.com/advisories/36201
Show 16 moreShow less
vupen.com/english/advisories/2009/2196
svn.apache.org/viewvc/xerces/c/trunk/src/xercesc/validators/DTD/DTDScanner.cpp?r1=781488&r2=781487&pathrev=781488&view=patch
mandriva.com/security/advisories?name=MDVSA-2009:223
exchange.xforce.ibmcloud.com/vulnerabilities/52321
bugzilla.redhat.com/show_bug.cgi?id=515515
nvd.nist.gov/vuln/detail/CVE-2009-1885
github.com/advisories/GHSA-m76p-wpqx-3m7x
security-tracker.debian.org/tracker/CVE-2009-1885
suse.com/security/cve/CVE-2009-1885