CVE-2009-2473
Fixed in a distro release EPSS 8%
neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Products: webdav neon
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 4 | neon | 0:0.24.7-4.el4_8.2 |
| Red Hat Enterprise Linux 4 | neon-debuginfo | 0:0.24.7-4.el4_8.2 |
| Red Hat Enterprise Linux 4 | neon-devel | 0:0.24.7-4.el4_8.2 |
| Red Hat Enterprise Linux 5 | gnome-vfs2 | 0:2.16.2-10.el5 |
| Red Hat Enterprise Linux 5 | gnome-vfs2-debuginfo | 0:2.16.2-10.el5 |
| Red Hat Enterprise Linux 5 | gnome-vfs2-devel | 0:2.16.2-10.el5 |
| Red Hat Enterprise Linux 5 | gnome-vfs2-smb | 0:2.16.2-10.el5 |
| Red Hat Enterprise Linux 5 | neon | 0:0.25.5-10.el5_4.1 |
| Red Hat Enterprise Linux 5 | neon-debuginfo | 0:0.25.5-10.el5_4.1 |
| Red Hat Enterprise Linux 5 | neon-devel | 0:0.25.5-10.el5_4.1 |