Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 6 Jun 2009 13:47:45 -0400 (EDT)
From: "Steven M. Christey" <>
cc: "Steven M. Christey" <>
Subject: Re: CVE request: "billion laughs" attack against
 Apache APR

Name: CVE-2009-1955
Status: Candidate
Reference: MILW0RM:8842
Reference: URL:
Reference: MLIST:[apr-dev] 20090602 [PATCH] prevent "billion laughs" attack against expat
Reference: URL:
Reference: MLIST:[oss-security] 20090603 CVE request: "billion laughs" attack against Apache APR
Reference: URL:
Reference: CONFIRM:
Reference: CONFIRM:
Reference: DEBIAN:DSA-1812
Reference: URL:
Reference: SECUNIA:35284
Reference: URL:
Reference: SECUNIA:35360
Reference: URL:

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in
Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn
modules in the Apache HTTP Server, allows remote attackers to cause a
denial of service (memory consumption) via a crafted XML document
containing a large number of nested entity references, as demonstrated
by a PROPFIND request, a similar issue to CVE-2003-1564.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.