Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
8.1
CVSSv3

CVE-2018-1311

Published: 18/12/2019 Updated: 16/02/2024
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Subscribe to Apache

Vulnerability Summary

The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache xerces-c\\+\\+

redhat enterprise linux desktop 7.0

redhat enterprise linux workstation 7.0

redhat enterprise linux server 7.0

redhat enterprise linux desktop 6.0

redhat enterprise linux server 6.0

redhat enterprise linux workstation 6.0

redhat enterprise linux server aus 7.7

redhat enterprise linux server tus 7.7

redhat enterprise linux eus 7.7

debian debian linux 9.0

debian debian linux 10.0

oracle goldengate

Vendor Advisories

Debian CVElist Bug Report Logs: xerces-c: CVE-2018-1311: use-after-free vulnerability processing external DTD
Debian Bug report logs - #947431 xerces-c: CVE-2018-1311: use-after-free vulnerability processing external DTD Package: src:xerces-c; Maintainer for src:xerces-c is William Blough <bblough@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 26 Dec 2019 20:42:05 UTC Severity: important Tags: ...
Red Hat: Important: xerces-c security update
Synopsis Important: xerces-c security update Type/Severity Security Advisory: Important Topic An update for xerces-c is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base scor ...
Red Hat: Important: xerces-c security update
Synopsis Important: xerces-c security update Type/Severity Security Advisory: Important Topic An update for xerces-c is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base scor ...
Debian Security Advisories: DSA-4814-1 xerces-c -- security update
It was discovered that xerces-c, a validating XML parser library for C++, did not correctly scan DTDs The use-after-free vulnerability resulting from this issue would allow a remote attacker to leverage a specially crafted XML file in order to crash the application or potentially execute arbitrary code Please note that the patch fixing this issue ...
Amazon Linux 2: ALAS2-2020-1415
A use-after-free vulnerability was found in xerces-c in the way an XML document is processed via the SAX API Applications that process XML documents with an external Document Type Definition (DTD) may be vulnerable to this flaw A remote attacker could exploit this flaw by creating a specially crafted XML file that would crash the application or p ...
Arch Linux Issues:
The Apache Xerces-C 300 to 323 XML parser contains a use-after-free error triggered during the scanning of external DTDs This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing This can be accomplished via the DOM using a standard parser feature, or via SAX u ...

References

CWE-416https://marc.info/?l=xerces-c-users&m=157653840106914&w=2https://access.redhat.com/errata/RHSA-2020:0704https://access.redhat.com/errata/RHSA-2020:0702https://lists.debian.org/debian-lts-announce/2020/12/msg00025.htmlhttps://www.debian.org/security/2020/dsa-4814https://www.oracle.com/security-alerts/cpujan2022.htmlhttps://lists.apache.org/thread.html/r48ea463fde218b1e4cc1a1d05770a0cea34de0600b4355315a49226b%40%3Cc-dev.xerces.apache.org%3Ehttps://lists.apache.org/thread.html/rabbcc0249de1dda70cda96fd9bcff78217be7a57d96e7dcc8cd96646%40%3Cc-users.xerces.apache.org%3Ehttps://lists.apache.org/thread.html/rfeb8abe36bcca91eb603deef49fbbe46870918830a66328a780b8625%40%3Cc-users.xerces.apache.org%3Ehttps://lists.apache.org/thread.html/r90ec105571622a7dc3a43b846c12732d2e563561dfb2f72941625f35%40%3Cc-users.xerces.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7A6WWL4SWKAVYK6VK5YN7KZP4MZWC7IY/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/https://lists.debian.org/debian-lts-announce/2023/12/msg00027.htmlhttp://www.openwall.com/lists/oss-security/2024/02/16/1https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947431https://www.debian.org/security/2020/dsa-4814https://nvd.nist.gov
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
race conditionCVE-2024-4249CVE-2024-4244CVE-2023-20198TCPCVE-2022-48648CVE-2022-48636CVE-2024-21345SQL
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook