CVE-2009-2416

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

• ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
• AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
• Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

1.96% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 79.9% of scored records. A rank, not a probability.

NVD base score

6.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-16.

Red Hat severity

Low. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2009-08-11 18:00Z17 YR AGO

Last updated

2025-01-21 15:30Z1 YR AGO

Reserved

2009-07-09

Assigning CNA

redhat

Record state

PUBLISHED

Severity

Medium (CVSS 6.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weaknesses

• CWE-416Use After FreeVariant

Data version

5.1

Document digest

95f51f7c62281c2edf56ba12279e103e7c7f13b22eed632ca8ecbfb6e7c8aa27

• www.ubuntu.comUSN-815-1http://www.ubuntu.com/usn/USN-815-1vendor-advisoryx_refsource_UBUNTU
• www.redhat.comFEDORA-2009-8491https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00537.htmlvendor-advisoryx_refsource_FEDORA
• secunia.com36631http://secunia.com/advisories/36631third-party-advisoryx_refsource_SECUNIA
• oval.cisecurity.orgoval:org.mitre.oval:def:9262https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9262vdb-entrysignaturex_refsource_OVAL
• www.networkworld.comhttp://www.networkworld.com/columnists/2009/080509-xml-flaw.htmlx_refsource_MISC
• bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=515205x_refsource_CONFIRM
• www.openoffice.orghttp://www.openoffice.org/security/cves/CVE-2009-2414-2416.htmlx_refsource_CONFIRM
• lists.apple.comAPPLE-SA-2009-11-11-1http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.htmlvendor-advisoryx_refsource_APPLE
• www.vupen.comADV-2009-3217http://www.vupen.com/english/advisories/2009/3217vdb-entryx_refsource_VUPEN
• secunia.com37471http://secunia.com/advisories/37471third-party-advisoryx_refsource_SECUNIA
• support.apple.comhttp://support.apple.com/kb/HT4225x_refsource_CONFIRM
• www.vupen.comADV-2009-2420http://www.vupen.com/english/advisories/2009/2420vdb-entryx_refsource_VUPEN
• www.redhat.comFEDORA-2009-8580https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00642.htmlvendor-advisoryx_refsource_FEDORA
• www.vmware.comhttp://www.vmware.com/security/advisories/VMSA-2009-0016.htmlx_refsource_CONFIRM
• secunia.com36417http://secunia.com/advisories/36417third-party-advisoryx_refsource_SECUNIA
• www.cert.fihttp://www.cert.fi/en/reports/2009/vulnerability2009085.htmlx_refsource_MISC
• www.codenomicon.comhttp://www.codenomicon.com/labs/xml/x_refsource_MISC
• lists.opensuse.orgSUSE-SR:2009:015http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.htmlvendor-advisoryx_refsource_SUSE
• support.apple.comhttp://support.apple.com/kb/HT3949x_refsource_CONFIRM
• www.mail-archive.com[debian-bugs-dist] 20090810 Bug#540865: libxml2: CVE-2009-2414, CVE-2009-2416 pointer-user-after-free and stack overflow because of function recursionhttp://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg678527.htmlmailing-listx_refsource_MLIST
• www.securityfocus.com36010http://www.securityfocus.com/bid/36010vdb-entryx_refsource_BID
• googlechromereleases.blogspot.comhttp://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.htmlx_refsource_CONFIRM
• www.securityfocus.com20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party componentshttp://www.securityfocus.com/archive/1/507985/100/0/threadedmailing-listx_refsource_BUGTRAQ
• git.gnome.orghttps://git.gnome.org/browse/libxml2/commit/?id=489f9671e71cc44a97b23111b3126ac8a1e21a59x_refsource_CONFIRM
• secunia.com35036http://secunia.com/advisories/35036third-party-advisoryx_refsource_SECUNIA
• secunia.com36338http://secunia.com/advisories/36338third-party-advisoryx_refsource_SECUNIA
• www.redhat.comFEDORA-2009-8498https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00547.htmlvendor-advisoryx_refsource_FEDORA
• oval.cisecurity.orgoval:org.mitre.oval:def:7783https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7783vdb-entrysignaturex_refsource_OVAL
• www.vupen.comADV-2009-3184http://www.vupen.com/english/advisories/2009/3184vdb-entryx_refsource_VUPEN
• www.debian.orgDSA-1859http://www.debian.org/security/2009/dsa-1859vendor-advisoryx_refsource_DEBIAN
• lists.apple.comAPPLE-SA-2009-11-09-1http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlvendor-advisoryx_refsource_APPLE
• lists.apple.comAPPLE-SA-2010-06-21-1http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.htmlvendor-advisoryx_refsource_APPLE
• secunia.com37346http://secunia.com/advisories/37346third-party-advisoryx_refsource_SECUNIA
• www.vupen.comADV-2009-3316http://www.vupen.com/english/advisories/2009/3316vdb-entryx_refsource_VUPEN
• support.apple.comhttp://support.apple.com/kb/HT3937x_refsource_CONFIRM
• secunia.com36207http://secunia.com/advisories/36207third-party-advisoryx_refsource_SECUNIA