Read the docs
TI-2009-02509 Aliases CVE-2009-2625GHSA-334p-wv2m-w3vp

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in…

Priority MEDIUM 46Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.

Why it matters now

EPSS 0.3038 98th percentileScored 2026-11-07
Fix Fixed xerces:xercesImpl (Maven): 2.10.0Red Hat: 19 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—xerces:xercesImpl (Maven)before 2.10.02.10.0Patch availableGHSA-334p-wv2m-w3vp
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • xerces:xercesImpl (Maven) Vendor— Affected before 2.10.0 Fixed in 2.10.0 Patch available GHSA-334p-wv2m-w3vp

CPE configurations NVD · 56

CPEVersionsRoleVendor
cpe:2.3:a:oracle:jdk:1.5.0:-:*:*:*:*:*:*1.5.0VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update1:*:*:*:*:*:*1.5.0 update1VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update10:*:*:*:*:*:*1.5.0 update10VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update11:*:*:*:*:*:*1.5.0 update11VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update12:*:*:*:*:*:*1.5.0 update12VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update13:*:*:*:*:*:*1.5.0 update13VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update14:*:*:*:*:*:*1.5.0 update14VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update15:*:*:*:*:*:*1.5.0 update15VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update16:*:*:*:*:*:*1.5.0 update16VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update17:*:*:*:*:*:*1.5.0 update17VulnerableOracle
  • cpe:2.3:a:oracle:jdk:1.5.0:-:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update1:*:*:*:*:*:* Versions 1.5.0 update1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update10:*:*:*:*:*:* Versions 1.5.0 update10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update11:*:*:*:*:*:* Versions 1.5.0 update11 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update12:*:*:*:*:*:* Versions 1.5.0 update12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update13:*:*:*:*:*:* Versions 1.5.0 update13 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update14:*:*:*:*:*:* Versions 1.5.0 update14 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update15:*:*:*:*:*:* Versions 1.5.0 update15 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update16:*:*:*:*:*:* Versions 1.5.0 update16 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update17:*:*:*:*:*:* Versions 1.5.0 update17 Vulnerable ·Oracle
Show 46 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:jdk:1.5.0:update18:*:*:*:*:*:*1.5.0 update18VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update19:*:*:*:*:*:*1.5.0 update19VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update2:*:*:*:*:*:*1.5.0 update2VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update3:*:*:*:*:*:*1.5.0 update3VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update4:*:*:*:*:*:*1.5.0 update4VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update5:*:*:*:*:*:*1.5.0 update5VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update6:*:*:*:*:*:*1.5.0 update6VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update7:*:*:*:*:*:*1.5.0 update7VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update8:*:*:*:*:*:*1.5.0 update8VulnerableOracle
cpe:2.3:a:oracle:jdk:1.5.0:update9:*:*:*:*:*:*1.5.0 update9VulnerableOracle
cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:*1.6.0VulnerableOracle
cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:*1.6.0 update1VulnerableOracle
cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:*1.6.0 update10VulnerableOracle
cpe:2.3:a:oracle:jdk:1.6.0:update11:*:*:*:*:*:*1.6.0 update11VulnerableOracle
cpe:2.3:a:oracle:jdk:1.6.0:update12:*:*:*:*:*:*1.6.0 update12VulnerableOracle
cpe:2.3:a:oracle:jdk:1.6.0:update13:*:*:*:*:*:*1.6.0 update13VulnerableOracle
cpe:2.3:a:oracle:jdk:1.6.0:update14:*:*:*:*:*:*1.6.0 update14VulnerableOracle
cpe:2.3:a:oracle:jdk:1.6.0:update2:*:*:*:*:*:*1.6.0 update2VulnerableOracle
cpe:2.3:a:oracle:jdk:1.6.0:update3:*:*:*:*:*:*1.6.0 update3VulnerableOracle
cpe:2.3:a:oracle:jdk:1.6.0:update4:*:*:*:*:*:*1.6.0 update4VulnerableOracle
cpe:2.3:a:oracle:jdk:1.6.0:update5:*:*:*:*:*:*1.6.0 update5VulnerableOracle
cpe:2.3:a:oracle:jdk:1.6.0:update6:*:*:*:*:*:*1.6.0 update6VulnerableOracle
cpe:2.3:a:oracle:jdk:1.6.0:update7:*:*:*:*:*:*1.6.0 update7VulnerableOracle
cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*10VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*11VulnerableFedoraproject
cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*11.0VulnerableopenSUSE
cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*11.1VulnerableopenSUSE
cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*11.2VulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*9VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*10 sp2VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*10 sp3VulnerableSUSE
cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*11VulnerableSUSE
cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*4.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*5.0VulnerableDebian
cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*6.06VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*8.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*8.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*9.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*9.10VulnerableCanonical
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:6.1:*:*:*:*:*:*:*6.1VulnerableOracle
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:6.2.1:*:*:*:*:*:*:*6.2.1VulnerableOracle
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:primavera_web_services:6.2.1:*:*:*:*:*:*:*6.2.1VulnerableOracle
cpe:2.3:a:oracle:primavera_web_services:7.0:-:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:primavera_web_services:7.0:sp1:*:*:*:*:*:*7.0 sp1VulnerableOracle
cpe:2.3:a:apache:xerces2_java:2.9.1:*:*:*:*:*:*:*2.9.1VulnerableApache
  • cpe:2.3:a:oracle:jdk:1.5.0:update18:*:*:*:*:*:* Versions 1.5.0 update18 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update19:*:*:*:*:*:* Versions 1.5.0 update19 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update2:*:*:*:*:*:* Versions 1.5.0 update2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update3:*:*:*:*:*:* Versions 1.5.0 update3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update4:*:*:*:*:*:* Versions 1.5.0 update4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update5:*:*:*:*:*:* Versions 1.5.0 update5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update6:*:*:*:*:*:* Versions 1.5.0 update6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update7:*:*:*:*:*:* Versions 1.5.0 update7 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update8:*:*:*:*:*:* Versions 1.5.0 update8 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.5.0:update9:*:*:*:*:*:* Versions 1.5.0 update9 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:* Versions 1.6.0 update1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:* Versions 1.6.0 update10 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.6.0:update11:*:*:*:*:*:* Versions 1.6.0 update11 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.6.0:update12:*:*:*:*:*:* Versions 1.6.0 update12 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.6.0:update13:*:*:*:*:*:* Versions 1.6.0 update13 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.6.0:update14:*:*:*:*:*:* Versions 1.6.0 update14 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.6.0:update2:*:*:*:*:*:* Versions 1.6.0 update2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.6.0:update3:*:*:*:*:*:* Versions 1.6.0 update3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.6.0:update4:*:*:*:*:*:* Versions 1.6.0 update4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.6.0:update5:*:*:*:*:*:* Versions 1.6.0 update5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.6.0:update6:*:*:*:*:*:* Versions 1.6.0 update6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jdk:1.6.0:update7:*:*:*:*:*:* Versions 1.6.0 update7 Vulnerable ·Oracle
  • cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:* Versions 11 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:* Versions 11.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:* Versions 11.2 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:* Versions 10 sp2 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:* Versions 10 sp3 Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:* Versions 11 Vulnerable ·SUSE
  • cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Debian
  • cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* Versions 6.06 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:* Versions 8.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:* Versions 8.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:* Versions 9.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:* Versions 9.10 Vulnerable ·Canonical
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:6.2.1:*:*:*:*:*:*:* Versions 6.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_web_services:6.2.1:*:*:*:*:*:*:* Versions 6.2.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_web_services:7.0:-:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_web_services:7.0:sp1:*:*:*:*:*:* Versions 7.0 sp1 Vulnerable ·Oracle
  • cpe:2.3:a:apache:xerces2_java:2.9.1:*:*:*:*:*:*:* Versions 2.9.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-334p-wv2m-w3vp xerces:xercesImpl (Maven) Fixed in 2.10.0 Advisory →

Red Hat 19 advisories

  • RHSA-2013:0763 Released 2013-04-22 · Red Hat rating Moderate
    JBoss Web Framework Kit 2.2.0 update
    • Red Hat JBoss Web Framework Kit 2.2
  • RHSA-2012:1537 Released 2012-12-04 · Red Hat rating Moderate
    jasperreports-server-pro security and bug fix update
    • RHEV-M for Servers jasperreports-server-pro-4.7.1-2.el6ev
  • RHSA-2012:1232 Released 2012-09-05 · Red Hat rating Important
    JBoss Enterprise Portal Platform 5.2.2 update
    • Red Hat JBoss Portal 5.2
Show 16 more Red Hat advisories
  • RHSA-2012:0725 Released 2012-06-12 · Red Hat rating Moderate
    JBoss Operations Network 3.1.0 update
    • Red Hat JBoss Operations Network 3.1
  • RHSA-2011:0858 Released 2011-06-08 · Red Hat rating Moderate
    xerces-j2 security update
    • Red Hat Enterprise Linux Desktop Optional (v. 6) xerces-j2-2.7.1-12.6.el6_0, xerces-j2-demo-2.7.1-12.6.el6_0, xerces-j2-javadoc-apis-2.7.1-12.6.el6_0 +4
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) xerces-j2-2.7.1-12.6.el6_0, xerces-j2-demo-2.7.1-12.6.el6_0, xerces-j2-javadoc-apis-2.7.1-12.6.el6_0 +4
    • Red Hat Enterprise Linux Server (v. 6) xerces-j2-2.7.1-12.6.el6_0
    • Red Hat Enterprise Linux Server Optional (v. 6) xerces-j2-2.7.1-12.6.el6_0, xerces-j2-demo-2.7.1-12.6.el6_0, xerces-j2-javadoc-apis-2.7.1-12.6.el6_0 +4
    • Red Hat Enterprise Linux Workstation (v. 6) xerces-j2-2.7.1-12.6.el6_0
    • Red Hat Enterprise Linux Workstation Optional (v. 6) xerces-j2-2.7.1-12.6.el6_0, xerces-j2-demo-2.7.1-12.6.el6_0, xerces-j2-javadoc-apis-2.7.1-12.6.el6_0 +4
  • RHSA-2010:0043 Released 2010-01-14 · Red Hat rating Low
    Red Hat Network Satellite Server IBM Java Runtime security update
    • Red Hat Satellite 5.3 (RHEL v.4) java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-devel-1:1.6.0.7-1jpp.3.el4 +1
    • Red Hat Satellite 5.3 (RHEL v.5) java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5, java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5.i386, java-1.6.0-ibm-devel-1:1.6.0.7-1jpp.2.el5 +1
  • RHSA-2009:1662 Released 2009-12-11 · Red Hat rating Low
    Red Hat Network Satellite Server Sun Java Runtime security update
    • Red Hat Satellite 5.1 (RHEL v.4 AS) java-1.5.0-sun-1.5.0.22-1jpp.1.el4, java-1.5.0-sun-1.5.0.22-1jpp.1.el4.i586, java-1.5.0-sun-devel-1.5.0.22-1jpp.1.el4 +1
  • RHSA-2009:1650 Released 2009-12-10 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 4.2.0.CP08 update
    • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server glassfish-jsf-1.2_13-2.1.ep1.el5, hibernate3-1:3.2.4-1.SP1_CP09.0jpp.ep1.2.4.el5, hibernate3-annotations-3.3.1-1.11GA_CP02.ep1.el5 +22
  • RHSA-2009:1649 Released 2009-12-09 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 4.3.0.CP07 update
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 Server glassfish-jaxb-2.1.4-1.12.patch03.1.ep1.el5, glassfish-jaxb-javadoc-2.1.4-1.12.patch03.1.ep1.el5, glassfish-jsf-1.2_13-2.1.ep1.el5 +31
  • RHSA-2009:1637 Released 2009-12-09 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 4.2.0.CP08 update
    • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS glassfish-javamail-1.4.2-0jpp.ep1.5.el4, glassfish-jsf-1.2_13-2.1.ep1.el4, hibernate3-1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4 +25
    • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES glassfish-javamail-1.4.2-0jpp.ep1.5.el4, glassfish-jsf-1.2_13-2.1.ep1.el4, hibernate3-1:3.2.4-1.SP1_CP09.0jpp.ep1.1.el4 +25
  • RHSA-2009:1636 Released 2009-12-09 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 4.3.0.CP07 update
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 AS glassfish-javamail-1.4.2-0jpp.ep1.5.el4, glassfish-jaxb-2.1.4-1.12.patch03.ep1.el4, glassfish-jaxb-javadoc-2.1.4-1.12.patch03.ep1.el4 +34
    • Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ES glassfish-javamail-1.4.2-0jpp.ep1.5.el4, glassfish-jaxb-2.1.4-1.12.patch03.ep1.el4, glassfish-jaxb-javadoc-2.1.4-1.12.patch03.ep1.el4 +34
  • RHSA-2009:1615 Released 2009-11-30 · Red Hat rating Moderate
    xerces-j2 security update
    • Red Hat Enterprise Linux (v. 5 server) xerces-j2-2.7.1-7jpp.2.el5_4.2, xerces-j2-2.7.1-7jpp.2.el5_4.2.i386, xerces-j2-2.7.1-7jpp.2.el5_4.2.ia64 +25
    • Red Hat Enterprise Linux Desktop (v. 5 client) xerces-j2-2.7.1-7jpp.2.el5_4.2, xerces-j2-2.7.1-7jpp.2.el5_4.2.i386, xerces-j2-scripts-2.7.1-7jpp.2.el5_4.2 +1
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xerces-j2-2.7.1-7jpp.2.el5_4.2, xerces-j2-demo-2.7.1-7jpp.2.el5_4.2, xerces-j2-demo-2.7.1-7jpp.2.el5_4.2.i386 +8
  • RHSA-2009:1582 Released 2009-11-12 · Red Hat rating Critical
    java-1.6.0-ibm security update
    • Red Hat Desktop version 4 Extras java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.6-1jpp.3.el4 +10
    • Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el4.i386, java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el4.ppc +17
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el5, java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el5.i386, java-1.6.0-ibm-accessibility-1:1.6.0.6-1jpp.3.el5 +12
    • Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.6-1jpp.3.el4 +10
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el5, java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el5.i386, java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el5.ppc +20
    • Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.6-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.6-1jpp.3.el4 +10
  • RHSA-2009:1551 Released 2009-11-04 · Red Hat rating Moderate
    java-1.4.2-ibm security update
    • RHEL 4 AS for SAP java-1.4.2-ibm-1.4.2.13.2.sap-1jpp.4.el4_8, java-1.4.2-ibm-demo-1.4.2.13.2.sap-1jpp.4.el4_8, java-1.4.2-ibm-devel-1.4.2.13.2.sap-1jpp.4.el4_8 +2
    • RHEL 5 Server for SAP java-1.4.2-ibm-1.4.2.13.2.sap-1jpp.4.el5_3, java-1.4.2-ibm-demo-1.4.2.13.2.sap-1jpp.4.el5_3, java-1.4.2-ibm-devel-1.4.2.13.2.sap-1jpp.4.el5_3 +2
  • RHSA-2009:1505 Released 2009-10-14 · Red Hat rating Moderate
    java-1.4.2-ibm security update
    • Red Hat Desktop version 3 Extras java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el3.i386, java-1.4.2-ibm-demo-1.4.2.13.1-1jpp.1.el3 +7
    • Red Hat Desktop version 4 Extras java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el4.i386, java-1.4.2-ibm-demo-1.4.2.13.1-1jpp.1.el4 +9
    • Red Hat Enterprise Linux AS version 3 Extras java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el3.i386, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el3.ia64 +17
    • Red Hat Enterprise Linux AS version 4 Extras java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el4.i386, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el4.ia64 +20
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el5, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el5.i386, java-1.4.2-ibm-demo-1.4.2.13.1-1jpp.1.el5 +9
    • Red Hat Enterprise Linux ES version 3 Extras java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el3.i386, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el3.ia64 +11
    • Red Hat Enterprise Linux ES version 4 Extras java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el4.i386, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el4.ia64 +13
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el5, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el5.i386, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el5.ia64 +20
    • Red Hat Enterprise Linux WS version 3 Extras java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el3, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el3.i386, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el3.ia64 +11
    • Red Hat Enterprise Linux WS version 4 Extras java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el4.i386, java-1.4.2-ibm-1.4.2.13.1-1jpp.1.el4.ia64 +13
  • RHSA-2009:1236 Released 2009-08-28 · Red Hat rating Critical
    java-1.5.0-ibm security update
    • Red Hat Desktop version 4 Extras java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el4, java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.10-1jpp.4.el4 +9
    • Red Hat Enterprise Linux AS version 4 Extras java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el4, java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el4.i386, java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el4.ppc +17
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el5, java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el5.i386, java-1.5.0-ibm-accessibility-1:1.5.0.10-1jpp.4.el5 +11
    • Red Hat Enterprise Linux ES version 4 Extras java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el4, java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.10-1jpp.4.el4 +9
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el5, java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el5.i386, java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el5.ppc +20
    • Red Hat Enterprise Linux WS version 4 Extras java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el4, java-1.5.0-ibm-1:1.5.0.10-1jpp.4.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.10-1jpp.4.el4 +9
  • RHSA-2009:1201 Released 2009-08-06 · Red Hat rating Important
    java-1.6.0-openjdk security and bug fix update
    • Red Hat Enterprise Linux (v. 5 server) java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5, java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386, java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5 +7
    • Red Hat Enterprise Linux Desktop (v. 5 client) java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5, java-1.6.0-openjdk-1:1.6.0.0-1.2.b09.el5.i386, java-1.6.0-openjdk-demo-1:1.6.0.0-1.2.b09.el5 +7
  • RHSA-2009:1200 Released 2009-08-06 · Red Hat rating Critical
    java-1.6.0-sun security update
    • Red Hat Desktop version 4 Extras java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el4 +9
    • Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el4 +9
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-sun-1:1.6.0.15-1jpp.1.el5, java-1.6.0-sun-1:1.6.0.15-1jpp.1.el5.i586, java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el5 +9
    • Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el4 +9
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-sun-1:1.6.0.15-1jpp.1.el5, java-1.6.0-sun-1:1.6.0.15-1jpp.1.el5.i586, java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el5 +9
    • Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.15-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.15-1jpp.1.el4 +9
  • RHSA-2009:1199 Released 2009-08-06 · Red Hat rating Critical
    java-1.5.0-sun security update
    • Red Hat Desktop version 4 Extras java-1.5.0-sun-1.5.0.20-1jpp.1.el4, java-1.5.0-sun-1.5.0.20-1jpp.1.el4.i586, java-1.5.0-sun-demo-1.5.0.20-1jpp.1.el4 +8
    • Red Hat Enterprise Linux AS version 4 Extras java-1.5.0-sun-1.5.0.20-1jpp.1.el4, java-1.5.0-sun-1.5.0.20-1jpp.1.el4.i586, java-1.5.0-sun-demo-1.5.0.20-1jpp.1.el4 +8
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.5.0-sun-1.5.0.20-1jpp.1.el5, java-1.5.0-sun-1.5.0.20-1jpp.1.el5.i586, java-1.5.0-sun-demo-1.5.0.20-1jpp.1.el5 +8
    • Red Hat Enterprise Linux ES version 4 Extras java-1.5.0-sun-1.5.0.20-1jpp.1.el4, java-1.5.0-sun-1.5.0.20-1jpp.1.el4.i586, java-1.5.0-sun-demo-1.5.0.20-1jpp.1.el4 +8
    • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.5.0-sun-1.5.0.20-1jpp.1.el5, java-1.5.0-sun-1.5.0.20-1jpp.1.el5.i586, java-1.5.0-sun-demo-1.5.0.20-1jpp.1.el5 +8
    • Red Hat Enterprise Linux WS version 4 Extras java-1.5.0-sun-1.5.0.20-1jpp.1.el4, java-1.5.0-sun-1.5.0.20-1jpp.1.el4.i586, java-1.5.0-sun-demo-1.5.0.20-1jpp.1.el4 +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEL 4 AS for SAPFixed RHSA-2009:1551
RHEL 5 Server for SAPFixed RHSA-2009:1551
RHEV-M for ServersFixed RHSA-2012:1537
Red Hat Desktop version 3 ExtrasFixed RHSA-2009:1505
Red Hat Desktop version 4 ExtrasFixed RHSA-2009:1199, RHSA-2009:1200, RHSA-2009:1236, RHSA-2009:1505, RHSA-2009:1582
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:1201, RHSA-2009:1615
Red Hat Enterprise Linux AS version 3 ExtrasFixed RHSA-2009:1505
Red Hat Enterprise Linux AS version 4 ExtrasFixed RHSA-2009:1199, RHSA-2009:1200, RHSA-2009:1236, RHSA-2009:1505, RHSA-2009:1582
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:1201, RHSA-2009:1615
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2011:0858
Red Hat Enterprise Linux Desktop Supplementary (v. 5)Fixed RHSA-2009:1199, RHSA-2009:1200, RHSA-2009:1236, RHSA-2009:1505, RHSA-2009:1582
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2009:1615
Red Hat Enterprise Linux ES version 3 ExtrasFixed RHSA-2009:1505
Red Hat Enterprise Linux ES version 4 ExtrasFixed RHSA-2009:1199, RHSA-2009:1200, RHSA-2009:1236, RHSA-2009:1505, RHSA-2009:1582
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2011:0858
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:0858
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2011:0858
Red Hat Enterprise Linux Server Supplementary (v. 5)Fixed RHSA-2009:1199, RHSA-2009:1200, RHSA-2009:1236, RHSA-2009:1505, RHSA-2009:1582
Red Hat Enterprise Linux WS version 3 ExtrasFixed RHSA-2009:1505
Red Hat Enterprise Linux WS version 4 ExtrasFixed RHSA-2009:1199, RHSA-2009:1200, RHSA-2009:1236, RHSA-2009:1505, RHSA-2009:1582
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2011:0858
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2011:0858
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ASFixed RHSA-2009:1637
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ESFixed RHSA-2009:1637
Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 ServerFixed RHSA-2009:1650
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ASFixed RHSA-2009:1636
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 4 ESFixed RHSA-2009:1636
Red Hat JBoss Enterprise Application Platform 4.3.0 for RHEL 5 ServerFixed RHSA-2009:1649
Red Hat JBoss Operations Network 3.1Fixed RHSA-2012:0725
Red Hat JBoss Portal 5.2Fixed RHSA-2012:1232
Red Hat JBoss Web Framework Kit 2.2Fixed RHSA-2013:0763
Red Hat Satellite 5.1 (RHEL v.4 AS)Fixed RHSA-2009:1662
Red Hat Satellite 5.3 (RHEL v.4)Fixed RHSA-2010:0043
Red Hat Satellite 5.3 (RHEL v.5)Fixed RHSA-2010:0043

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-2625
  2. 2026-10-03 Alias added: GHSA-334p-wv2m-w3vp

References

Patch 4

Advisory 40

Other 8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences