Published: 24/03/2015 Updated: 05/02/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

internal/XMLReader.cpp in Apache Xerces-C prior to 3.1.2 allows remote malicious users to cause a denial of service (segmentation fault and crash) via crafted XML data.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 7.1
fedoraproject fedora 22
fedoraproject fedora 20
fedoraproject fedora 21
apache xerces-c\\+\\+

Debian Bug report logs - #780827 xerces-c: CVE-2015-0252: Apache Xerces-C XML Parser Crashes on Malformed Input Package: src:xerces-c; Maintainer for src:xerces-c is William Blough <bblough@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 20 Mar 2015 05:54:01 UTC Severity: grave Tags: fix ...

A flaw was found in the way the Xerces-C XML parser processed certain XML documents A remote attacker could provide specially crafted XML input that, when parsed by an application using Xerces-C, would cause that application to crash ...

# Exploit Title: Apache Xerces-C XML Parser (< 312) DoS POC # Date: 2015-05-03 # Exploit Author: beford # Vendor Homepage: xercesapacheorg/#xerces-c # Version: Versions prior to 312 # Tested on: Ubuntu 1504 # CVE : CVE-2015-0252 Apache Xerces-C XML Parser Crashes on Malformed Input I believe this to be the same issue that was rep ...

Apache Xerces-C XML Parser versions prior to 312 denial of service proof of concept exploit ...

CWE-20 http://www.debian.org/security/2015/dsa-3199 http://xerces.apache.org/xerces-c/secadv/CVE-2015-0252.txt http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153094.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152882.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153887.html https://shibboleth.net/community/advisories/secadv_20150319.txt http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153903.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153923.html http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153829.html http://packetstormsecurity.com/files/131756/Apache-Xerces-C-XML-Parser-Denial-Of-Service.html https://www.exploit-db.com/exploits/36906/http://lists.opensuse.org/opensuse-updates/2016-04/msg00012.html http://www.securityfocus.com/bid/73252 http://rhn.redhat.com/errata/RHSA-2015-1193.html http://www.securitytracker.com/id/1032254 http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780827 https://www.exploit-db.com/exploits/36906/https://access.redhat.com/security/cve/cve-2015-0252

CVE-2015-0252

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect