CVE-2009-2416: Apple iPhone OS

Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days.

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.

Affected products

• Apple iPhone OS: from 2.0, before 4.0 (fixed in 4.0)
• Apple Mac OS X: before 10.4.11 (fixed in 10.4.11); from 10.5.0, before 10.5.8 (fixed in 10.5.8); from 10.6.0, before 10.6.2 (fixed in 10.6.2)
• Apple Mac OS X Server: before 10.4.11 (fixed in 10.4.11); from 10.5.0, before 10.5.8 (fixed in 10.5.8); from 10.6.0, before 10.6.2 (fixed in 10.6.2)
• Apple Safari: before 4.0.4 (fixed in 4.0.4)
• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 8.10 only; version 9.04 only
• Debian Debian Linux: version 4.0 only
• Fedoraproject Fedora: version 10 only; version 11 only
• Google Chrome: before 2.0.172.43 (fixed in 2.0.172.43)
• Opensuse Opensuse: from 10.3, up to and including 11.1
• Red Hat Enterprise Linux: version 3.0 only; version 4.0 only; version 5.0 only
• Sun Openoffice.org: from 2.0.0, before 2.4.3 (fixed in 2.4.3); from 3.0.0, before 3.1.1 (fixed in 3.1.1)
• Suse Linux Enterprise: version 10.0 only; version 11.0 only
• Suse Linux Enterprise Server: version 9 only
• VMware Esx: version 3.0.3 only; version 3.5 only; version 4.0 only
• VMware ESXi: version 3.5 only; version 4.0 only
• VMware vCenter Server: version 4.0 only
• VMware Vma: version 4.0 only
• Xmlsoft Libxml: version 1.8.17 only
• Xmlsoft LIBXML2: version 2.5.10 only; version 2.6.16 only; version 2.6.26 only; version 2.6.27 only; version 2.6.32 only

Published 2009-08-11. Last modified 2026-06-16.