CVE-2009-3720
Publication date 3 November 2009
Last updated 24 July 2024
Ubuntu priority
Description
The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.
Status
| Package | Ubuntu Release | Status | 
|---|---|---|
| apache2 | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | 
                                Not affected 
                                
                               | |
| apr-util | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | 
                                Not affected 
                                
                               | |
| expat | 25.10 questing | 
                                Fixed 2.0.1-7ubuntu1 
                                
                               | 
| 25.04 plucky | 
                                Fixed 2.0.1-7ubuntu1 
                                
                               | |
| 24.04 LTS noble | 
                                Fixed 2.0.1-7ubuntu1 
                                
                               | |
| 22.04 LTS jammy | 
                                Fixed 2.0.1-7ubuntu1 
                                
                               | |
| 20.04 LTS focal | 
                                Fixed 2.0.1-7ubuntu1 
                                
                               | |
| 18.04 LTS bionic | 
                                Fixed 2.0.1-7ubuntu1 
                                
                               | |
| 16.04 LTS xenial | 
                                Fixed 2.0.1-7ubuntu1 
                                
                               | |
| 14.04 LTS trusty | 
                                Fixed 2.0.1-7ubuntu1 
                                
                               | |
| cmake | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| celementtree | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| paraview | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| vnc4 | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | 
                                Not affected 
                                
                               | |
| poco | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | 
                                Not affected 
                                
                               | |
| kompozer | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| cadaver | 25.10 questing | 
                                Vulnerable 
                                
                               | 
| 25.04 plucky | 
                                Vulnerable 
                                
                               | |
| 24.04 LTS noble | 
                                Vulnerable 
                                
                               | |
| 22.04 LTS jammy | 
                                Vulnerable 
                                
                               | |
| 20.04 LTS focal | 
                                Vulnerable 
                                
                               | |
| 18.04 LTS bionic | 
                                Vulnerable 
                                
                               | |
| 16.04 LTS xenial | 
                                Vulnerable 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| ayttm | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| audacity | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| matanza | 25.10 questing | Ignored | 
| 25.04 plucky | Ignored | |
| 24.04 LTS noble | Ignored | |
| 22.04 LTS jammy | Ignored | |
| 20.04 LTS focal | Ignored | |
| 18.04 LTS bionic | Ignored | |
| 16.04 LTS xenial | Ignored | |
| 14.04 LTS trusty | Not in release | |
| libxmltok | 25.10 questing | Not in release | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Ignored end of standard support | |
| smart | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| texlive-bin | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| wxwidgets2.8 | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| tla | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| libparagui1.1 | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| sitecopy | 25.10 questing | 
                                Needs evaluation 
                                
                               | 
| 25.04 plucky | 
                                Needs evaluation 
                                
                               | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| wbxml2 | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| xulrunner | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| insighttoolkit | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | 
                                Needs evaluation 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| wxwindows2.4 | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| cableswig | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | 
                                Needs evaluation 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| gdcm | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | 
                                Not affected 
                                
                               | |
| grmonitor | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| tdom | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| vtk | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | 
                                Not affected 
                                
                               | |
| coin3 | 25.10 questing | 
                                Vulnerable 
                                
                               | 
| 25.04 plucky | 
                                Vulnerable 
                                
                               | |
| 24.04 LTS noble | 
                                Vulnerable 
                                
                               | |
| 22.04 LTS jammy | 
                                Vulnerable 
                                
                               | |
| 20.04 LTS focal | 
                                Vulnerable 
                                
                               | |
| 18.04 LTS bionic | 
                                Vulnerable 
                                
                               | |
| 16.04 LTS xenial | 
                                Vulnerable 
                                
                               | |
| 14.04 LTS trusty | 
                                Vulnerable 
                                
                               | |
| swish-e | 25.10 questing | 
                                Needs evaluation 
                                
                               | 
| 25.04 plucky | 
                                Needs evaluation 
                                
                               | |
| 24.04 LTS noble | 
                                Needs evaluation 
                                
                               | |
| 22.04 LTS jammy | 
                                Needs evaluation 
                                
                               | |
| 20.04 LTS focal | 
                                Needs evaluation 
                                
                               | |
| 18.04 LTS bionic | 
                                Needs evaluation 
                                
                               | |
| 16.04 LTS xenial | 
                                Needs evaluation 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| python-xml | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| python2.4 | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| python2.5 | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| python2.6 | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| w3c-libwww | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| wxwidgets2.6 | 25.10 questing | Not in release | 
| 25.04 plucky | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
| xmlrpc-c | 25.10 questing | 
                                Fixed 1.06.27-1ubuntu7 
                                
                               | 
| 25.04 plucky | 
                                Fixed 1.06.27-1ubuntu7 
                                
                               | |
| 24.04 LTS noble | 
                                Fixed 1.06.27-1ubuntu7 
                                
                               | |
| 22.04 LTS jammy | 
                                Fixed 1.06.27-1ubuntu7 
                                
                               | |
| 20.04 LTS focal | 
                                Fixed 1.06.27-1ubuntu7 
                                
                               | |
| 18.04 LTS bionic | 
                                Fixed 1.06.27-1ubuntu7 
                                
                               | |
| 16.04 LTS xenial | 
                                Fixed 1.06.27-1ubuntu7 
                                
                               | |
| 14.04 LTS trusty | 
                                Fixed 1.06.27-1ubuntu7 
                                
                               | |
| xotcl | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| ghostscript | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
| simgear | 25.10 questing | 
                                Not affected 
                                
                               | 
| 25.04 plucky | 
                                Not affected 
                                
                               | |
| 24.04 LTS noble | 
                                Not affected 
                                
                               | |
| 22.04 LTS jammy | 
                                Not affected 
                                
                               | |
| 20.04 LTS focal | 
                                Not affected 
                                
                               | |
| 18.04 LTS bionic | 
                                Not affected 
                                
                               | |
| 16.04 LTS xenial | 
                                Not affected 
                                
                               | |
| 14.04 LTS trusty | Not in release | |
Notes
jdstrand
both this and CVE-2009-2625 refer to the same expat bug: #1990430. See http://www.openwall.com/lists/oss-security/2009/09/06/1 This CVE was later assigned to the same issue, since CVE-2009-2625 was worded as a Java vulnerability. Our USN references CVE-2009-2625 and this CVE will be ignored (for expat). jdstrand provided updates in supported releases for expat, xmlrpc-c, cmake, python-xml, python2.4, and python2.5
ebarretto
this is not an issue for vnc4, for more information see: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560949
ccdm94
cmake 3.20.5 and forward uses expat 2.2.10+.
Patch details
| Package | Patch details | 
|---|---|
| expat | 
References
Related Ubuntu Security Notices (USN)
- USN-890-2
- Python 2.5 vulnerabilities
- 21 January 2010
- USN-890-6
- CMake vulnerabilities
- 15 April 2010
- USN-890-1
- Expat vulnerabilities
- 20 January 2010
- USN-890-4
- PyXML vulnerabilities
- 26 January 2010
- USN-890-3
- Python 2.4 vulnerabilities
- 22 January 2010
- USN-890-5
- XML-RPC for C and C++ vulnerabilities
- 18 February 2010