CVE-2009-2625

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20…

published August 6, 2009

CVSS

—

EPSS

30%

Percentile

98.2

In the wild

Unconfirmed

What it is

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.30380 · 98.2th percentile
Published: 2009-08-06T15:00Z

EPSS history

Timeline

06 AUG 15:00Z
XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20…
cvelistv5