CVE-2009-2473

Name	CVE-2009-2473
Description	neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
neon27 (PTS)	bullseye	0.31.2-1	fixed
	bookworm	0.32.5-1	fixed
	trixie	0.34.2-1	fixed
	forky, sid	0.35.0-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
neon	source	etch	(not affected)
neon	source	(unstable)	(unfixed)
neon26	source	(unstable)	(not affected)
neon27	source	(unstable)	(not affected)

Notes

- neon27 <not-affected> (neon27 is compiled to use libxml2 instead of expat)
- neon26 <not-affected> (neon26 is compiled to use libxml2 instead of expat)
[etch] - neon <not-affected> (neon is compiled to use libxml2 instead of expat)